Security audit

mearl

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent browser/API debugging tool, but it grants broad authenticated browser, cookie, file-read, and request-tampering capabilities without enough safety boundaries or warnings.

Install only if you trust the Mearl tooling and intend to let agents operate authenticated browser sessions. Use it in test or approved environments, avoid production/account-changing requests unless explicitly intended, review active mocks/rules, keep connector tokens private, and do not use file references with secrets unless you mean to send that content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The examples add a `get_user_info` capability that returns employee identifiers and, in detailed mode, extensive personal and organizational profile data. That goes beyond the stated browser/API-debugging focus and creates an unnecessary data-exposure path that could be abused for privacy violations, internal reconnaissance, or downstream social-engineering support.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README advertises capabilities to read sensitive browser and user data, including network requests, console logs, API schema, selected element details, user identity information, and SSO-backed account switching, but provides no privacy, consent, or data-handling warning. In this skill context, those features directly expose authenticated session data and potentially personal or internal enterprise information, making omission of warnings materially dangerous rather than merely incomplete documentation.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README documents traffic and behavior modification features such as API mocking, request redirection, header modification, and request blocking without warning that they can alter application behavior, mask real defects, or be abused to tamper with authenticated flows. Because this skill is specifically designed to operate against live browser sessions and signed requests, undocumented misuse can impact debugging integrity, testing safety, and possibly production-facing interactions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly exposes `page_eval`, which allows arbitrary JavaScript execution in the live page context, but the documentation does not prominently warn that this can modify DOM state, trigger authenticated actions, or exfiltrate page data visible to the script. In a browser-automation skill that also supports clicks, uploads, and authenticated contexts, lack of a clear safety warning increases the chance of unsafe use and abuse.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill advertises proxying HTTP/mtop requests with reused browser cookies and signatures, including logged-in session context, but does not provide an explicit warning that these requests execute with the user's authenticated identity. This creates a meaningful risk of unauthorized data access, account actions, CSRF-like misuse, or sensitive data exfiltration if an agent or prompt directs the tool toward attacker-chosen endpoints or operations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation explicitly describes launching managed browser instances, copying authenticated cookies across browser contexts, and reusing login state to call APIs. In a skill whose stated purpose is to reuse browser cookies/signatures for authenticated requests, this materially increases the risk of account/session abuse, lateral access to internal resources, and unintended data disclosure if an agent invokes these features without strong user awareness and authorization boundaries.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The file-reference feature allows any top-level payload field beginning with '@' to read local files, with missing/unreadable paths silently preserved instead of rejected. In an agent skill that can send requests, inject scripts, mock responses, and upload files, this creates a realistic path for arbitrary local file exfiltration or accidental disclosure of sensitive host data without an explicit warning or safety gate.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The generic HTTP request capability automatically attaches browser cookies by default and supports arbitrary target URLs, effectively enabling authenticated requests to be proxied to external or internal services. In the context of this skill, which is specifically designed to reuse browser login state and request signatures, the lack of a prominent warning and tighter safeguards makes credential leakage, CSRF-like actioning, and sensitive data exfiltration substantially more dangerous.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The detailed user info example exposes sensitive workforce data such as full name, department, BU, employee IDs, and related metadata without any warning about sensitivity, least-privilege use, or handling restrictions. In a tool designed to reuse authenticated browser context, that omission increases the chance of over-collection and accidental disclosure of internal personal data.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The managed-browser examples show logging into test accounts and copying cookies across domains/instances without emphasizing that cookies and authenticated sessions are credential-equivalent secrets. In this skill's context, session reuse is a core feature, so normalizing cookie copying without safeguards materially raises the risk of account takeover, privilege misuse, and lateral access to internal or third-party systems.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The troubleshooting guide instructs users to copy and run a `wss://...?...token=...` connection command, which exposes a bearer-style token directly in command history, screenshots, logs, chat, and clipboard flows. Because possession of the token may be sufficient to attach a local browser to the cloud agent session, anyone who obtains it could potentially access browser-backed capabilities or session-linked traffic until the token expires or is revoked.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.