T08 · Insecure Dependencies
Error
- Location
scripts/setup.py:51- Finding
Mutable External Templates Are Copied and Presented for Execution Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Jarvis Browser Setup
Security checks for vulnerabilities and agentic risk
Overview
This skill is for browser-control setup, but it uses unreviewed local templates and makes misleading security/setup claims around authentication and sharing.
Review this before installing or running. Do not share the generated folder as-is because it contains the auth token. Only use it after the server and extension templates are bundled or integrity-checked, the generated token is confirmed to be applied on both sides, and the service exposure is limited to the intended network and user.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.py:31- Finding
Generated Authentication Token Is Not Applied to the Server or Browser Extension
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.py:31- Finding
Browser-Control Credential Is Printed and Stored in Multiple Plaintext Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill claims fully automated, ready-to-use secure setup, but the described behavior is incomplete and may omit critical configuration such as proper token propagation while still starting or preparing a server package. This mismatch is dangerous because users may deploy a browser-control system believing it is securely configured when authentication or setup steps are missing, leading to exposed or nonfunctional remote-control infrastructure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file describes behavior that affects user data and filesystem state, including copying files, configuring them with a token, and creating a generated folder structure. Under the markdown-specific warning rule, the description should clearly disclose that the setup performs local file creation and modification before the user runs it.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill advertises automated setup that generates tokens and writes configuration/artifact files, yet it declares no explicit tool scope or permissions boundary. In an agent environment, missing scope disclosure can lead to unintended file reads/writes without adequate user awareness or policy enforcement, increasing the chance of overbroad access or misuse.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrase "Setup Jarvis Browser for me" is broad and natural-language generic, which raises the risk of accidental invocation in unrelated conversations. Because this skill performs security-sensitive actions like token generation, server setup, and file creation, unintended activation could create services or credentials without the user's informed intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description does not prominently warn that it will automatically generate authentication tokens, create files, and start a WebSocket server. In the context of a browser-control system, omitting those warnings reduces informed consent and can cause users to expose local services or distribute sensitive configuration artifacts unknowingly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The setup writes the generated browser-control auth token to plaintext files on disk and also prints it to stdout. In this skill context, the token grants browser control, so plaintext storage and display increase the chance of credential exposure through logs, shell history capture, backups, shared folders, or accidental disclosure when the package is distributed.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script generates a new auth token but does not propagate it into the copied server and extension files, only partially updating the extension WebSocket URL. This can leave the deployed package using stale/default authentication material or mismatched settings, which may cause users to run an instance with ineffective authentication or fall back to insecure manual fixes.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill manifest claims the setup is fully automated with no manual steps required, yet the code generates instructions telling the user to manually start the server and manually load the unpacked extension in Chrome. This is a direct contradiction between the skill's stated intent and what the code actually prepares users to do.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Natural-language policy issues apply to all file types, including markdown. The operational instructions and key descriptions are presented in German, which can impose a language constraint on users without opt-in or explanation.
- Content