e2e-verify

• Outcome: Review
• Latest audit: Aug 28, 2026 · 4:37 PM UTC
• Version: 1.0.1

Overview

The skill is mostly aligned with browser-based web testing, but it has review-worthy risks around unsafe .env loading and conflicting guidance about production use.

Install only if you are comfortable with a browser-testing skill that can install local tooling, use LLM API credentials, and send page context to a selected LLM provider. Review or patch the activation helper before use, avoid sourcing it from untrusted project directories, keep it off production targets, and use throwaway non-production accounts and data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill describes behavior that uses shell, network, file reads, and environment access without any declared permission boundary, which creates hidden capability escalation for a browser-testing workflow. In this context, those capabilities can expose secrets from .env files, execute installer scripts, and make unintended outbound connections while the user believes they are only invoking a constrained e2e verification skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a strong true positive because the documented purpose is safe, bounded e2e verification, but the actual behavior reportedly reads credentials from local and home .env files, auto-connects to multiple external LLM providers, probes local services, and lacks enforcement of the advertised safety gates. That mismatch is dangerous because users may trust the skill's stated constraints while it performs materially broader actions, including secret access and network egress, outside the expected testing scope.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The documentation explicitly states browser-use can 'Test localhost, staging, production', which directly contradicts the skill metadata safety gate of 'never production'. In an agent skill, this kind of contradictory guidance is dangerous because downstream agents may follow the more specific engine documentation and run exploratory browser actions against live systems, potentially touching real data or performing irreversible actions.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The capabilities table includes permission to test production, creating a direct policy conflict inside the same skill package. Because this file is operational guidance for an AI-driven browser agent that can click, type, and submit forms, the contradiction materially increases the chance of unsafe real-world execution against live applications.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The durable-test section instructs users to commit browser-use verification scripts under tests/browser-use/ and run them in CI, which conflicts with the manifest's routing rule that regression-critical durable flows should use Playwright under write-tests discipline. This weakens test safety and governance by encouraging nondeterministic AI-agent checks where the skill contract expects durable, reviewable scripted coverage for critical flows.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The generated activation helper sources both $HOME/.env and the current working directory's .env using the shell '.' operator, which executes shell syntax rather than safely parsing simple key/value pairs. Because activation is intended to be run manually from arbitrary directories, a malicious project-local .env can execute commands whenever the user sources activate.sh, turning environment setup into arbitrary code execution and implicit secret loading.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger phrases are broad enough to match ordinary requests like 'test my web app' or 'does it actually work,' which can cause accidental invocation of a skill with browser, shell, file, and network capabilities. In this skill's context, unintended activation is more dangerous than usual because it may lead to running tooling, touching local services, or initiating external-provider flows the user did not specifically request.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The usage examples repeat broad invocation language without precise boundaries, increasing the chance that the skill is selected for adjacent tasks that are not true e2e verification. Because this skill can drive a browser and potentially trigger installation, credential loading, or network/provider interactions, ambiguous routing can expose users to unintended side effects.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The helper silently imports environment files from both the user's home directory and the current working directory with no confirmation. In shell, sourcing a file is code execution, so an attacker who can influence the current directory contents can run arbitrary commands during activation and populate the environment with attacker-chosen values, including credential endpoints or proxy settings.

Credential Access

High

• Category: Privilege Escalation

Content

export BROWSER_USE_VENV="$_VENV_DIR"

# Load LLM API keys from .env files if available
for _envfile in "$HOME/.env" "$(pwd)/.env"; do
    if [ -f "$_envfile" ]; then
        set -a

• Confidence: 88% confidence
• Finding: The code is designed to load LLM API keys from .env files, which expands the browser-testing skill's access to sensitive credentials. In this skill context, that is more dangerous because the tool installs and enables AI/browser automation, so automatically importing secrets from arbitrary locations can expose credentials to unintended code paths or attacker-controlled runtime configuration.

Credential Access

High

• Category: Privilege Escalation

Content

export BROWSER_USE_VENV="$_VENV_DIR"

# Load LLM API keys from .env files if available
for _envfile in "$HOME/.env" "$(pwd)/.env"; do
    if [ -f "$_envfile" ]; then
        set -a
        . "$_envfile"

• Confidence: 96% confidence
• Finding: Because the helper sources both trusted and untrusted .env locations, it can pull credentials into the environment and simultaneously execute attacker-controlled shell content. That combination creates a realistic path to credential theft or misuse, such as exfiltrating loaded API keys or altering provider settings to send future requests to attacker infrastructure.

Credential Access

High

• Category: Privilege Escalation

Content

export BROWSER_USE_VENV="$_VENV_DIR"

# Load LLM API keys from .env files if available
for _envfile in "$HOME/.env" "$(pwd)/.env"; do
    if [ -f "$_envfile" ]; then
        set -a
        . "$_envfile"

• Confidence: 96% confidence
• Finding: Because the helper sources both trusted and untrusted .env locations, it can pull credentials into the environment and simultaneously execute attacker-controlled shell content. That combination creates a realistic path to credential theft or misuse, such as exfiltrating loaded API keys or altering provider settings to send future requests to attacker infrastructure.

Static analysis

No suspicious patterns detected.