Security audit

Chrome Devtools Remote

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed remote-browser control skill with real operational risks, but I found no hidden, deceptive, or purpose-mismatched behavior.

Use this only with a remote browser server you control or trust. Prefer a pinned reviewed package version or local install, avoid the pkce workaround unless necessary, do not use --insecure with hosted or sensitive endpoints, and avoid sending bearer tokens or login credentials unless the endpoint and network path are trusted.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:25
Finding: Unpinned Global npm Package Installation
Content: View full analysis
Remediation: View remediation
``` 2. Prefer a project-local installation over a global installation to reduce the affected scope. 3. Maintain a lockfile and use `npm ci` so dependency resolution is reproducible. 4. Verify package provenance and integrity through trusted registry metadata, integrity hashes, signatures, or npm provenance attestations. 5. Avoid the ad hoc `npm install pkce-challenge --no-save` mutation. Use a reviewed release in which the dependency is correctly declared and locked. 6. Disable package lifecycle scripts during installation where operationally possible, then explicitly review any scripts that are required. 7. Run the CLI under a dedicated, least-privileged account without access to unrelated credentials or sensitive files. 8. Document the exact supported package version and establish a controlled process for reviewing and updating it. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:53
Finding: TLS Certificate Verification Can Be Disabled for Remote MCP Connections
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
Connection-time flags: | Situation | What to pass | | ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | | Self-signed cert (common on tailnets without Tailscale-issued certs) | `--insecure` on every call, or `export CHROME_DEVTOOLS_MCP_REMOTE_INSECURE=1` | | Bearer-token gateway | `--header "Authorization: Bearer $TOKEN"` — repeatable, **not** cached, must be on every invocation |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
## Failure modes | Symptom | Cause | Fix | | --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | | `Failed to reach remote` | DNS, Tailscale offline, or wrong URL | `tailscale status` on the local box; verify `--remote` URL | | `Streamable HTTP error: ... 404 Session not found` | Server restarted; sticky id was stale. Retried once internally — if you see this it means the retry also 404'd | `chrome-devtools stop --remote $URL` to wipe the sticky pointer, then retry the command |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
## Failure modes | Symptom | Cause | Fix | | --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | | `Failed to reach remote` | DNS, Tailscale offline, or wrong URL | `tailscale status` on the local box; verify `--remote` URL | | `Streamable HTTP error: ... 404 Session not found` | Server restarted; sticky id was stale. Retried once internally — if you see this it means the retry also 404'd | `chrome-devtools stop --remote $URL` to wipe the sticky pointer, then retry the command |