webcli

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:26 PM UTC
• Version: 0.2.1

Overview

The skill is a coherent browser automation wrapper, but it exposes sensitive browser actions and session handling without enough user-control guidance and uses mutable global installs.

Review before installing. Use this only in an isolated environment with a reviewed, pinned package version where possible. Avoid using it on logged-in or sensitive sites unless you explicitly approve each submission, upload, cookie export/import, storage change, or browser-state save/load, and stop the daemon when finished.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Global Installation of Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–16
Vulnerability Type: Unpinned and globally installed third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash

npm install -g @erdinccurebal/webcli
npx playwright install chromium

Technical Analysis

The documented prerequisites instruct users or agents to globally install @erdinccurebal/webcli without specifying a reviewed version or integrity value. They also invoke Playwright through npx without pinning the package version that must provide the executable.

Consequently, package resolution can change after the Skill has been reviewed. A later package release, compromised publisher account, malicious transitive dependency, or registry-resolution issue could introduce attacker-controlled code. npm packages can execute lifecycle scripts during installation, including during global installation, with the permissions of the invoking user.

The global installation also expands the potential effect beyond an isolated project environment by modifying the user's global Node.js package environment. The evidence does not establish that the referenced packages are currently malicious; the vulnerability is the unsafe, mutable dependency-installation process.

Attack Path

1. An attacker compromises the package publisher, a transitive dependency, or the relevant package-distribution channel.
2. The attacker publishes a malicious release or modifies a dependency selected by unconstrained version resolution.
3. A user or AI agent follows the prerequisites and runs the documented commands.
4. npm or npx resolves the attacker-controlled package version because no reviewed version or integrity constraint is specified.
5. Malicious package code or an installation lifecycle script executes locally with the invoking user's privileges.
6. The malicious code can access data available to that user and alter the global Node.js env ...[truncated 739 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every directly invoked package to a reviewed, exact version rather than relying on the latest registry release.
2. Install dependencies within an isolated project or container instead of modifying the global Node.js environment.
3. Maintain and verify a lockfile and package integrity metadata from a trusted registry.
4. Avoid ambiguous npx resolution. Invoke a locally installed, version-pinned Playwright executable, or use an explicit reviewed package version.
5. Review package provenance, publisher ownership, transitive dependencies, release signatures, and lifecycle scripts before approving upgrades.
6. Disable npm lifecycle scripts during installation where operationally feasible, then explicitly run only reviewed setup steps.
7. Execute browser tooling with a dedicated, non-privileged account and restrict its filesystem, environment-variable, credential, and network access.
8. Document the expected package registry and reject dependency resolution from untrusted or user-controlled registries.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation criteria are broad enough to invoke this skill for nearly any request involving visiting a website or interacting with a web app, which increases the chance an agent will use a highly capable browser tool for sensitive or state-changing actions without sufficient user confirmation. Because the skill supports clicking, form submission, uploads, storage manipulation, and script evaluation, over-broad routing materially raises misuse risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to run npx playwright install chromium without pinning a specific version, which makes the dependency resolution non-deterministic and can expose users to supply-chain risk if an unexpected or compromised package version is fetched. In a skill meant to enable browser automation, this matters because the installed browser tooling will execute locally with the user's privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation describes powerful state-changing features such as clicks, form filling, uploads, cookie import/export, localStorage manipulation, and browser state save/load, but does not warn that these can modify accounts, leak sensitive data, or persist credentials/session material. In the context of a browser automation skill, omission of such warnings is especially dangerous because agents may perform destructive or privacy-impacting actions on real sites under user sessions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.