T09 · Insecure Skill Coding Practices
- Location
script.js:9- Finding
Unrestricted MCP Server Receives the Browser CDP Endpoint and Sign-In Identifier
- Content
View full analysis
Vulnerability Details
File Location:
script.js:9-19, 35-50
Vulnerability Type: Sensitive endpoint disclosure to an unrestricted remote service
Risk Level: Highjs const SERVER_URL = process.env.SERVER_URL; const MCP_URL = `${SERVER_URL}/mcp`; const CDP_URL = process.env.CDP_URL; if (!CDP_URL) { throw new Error("CDP URL environment variable is required."); } if (!SERVER_URL) { throw new Error("SERVER URL environment variable is required."); } async function connectMcp(signinId) { // Disconnect if already connected to allow reconnection try { await mcpClient.close().catch(() => {}); } catch { // Ignore errors if not connected } const transport = new StreamableHTTPClientTransport(new URL(MCP_URL), { requestInit: { headers: { "x-signin-id": signinId ?? "", "x-incognito": "1", "x-cdp-url": CDP_URL, }, }, }); await mcpClient.connect(transport); }Technical Analysis
SERVER_URLis accepted directly from the environment and used without enforcing HTTPS, validating the destination against an allowlist, or requiring explicit approval for a new endpoint. The client then transmits bothCDP_URLandsigninIdto that server as HTTP headers.A Chrome DevTools Protocol endpoint can provide extensive browser-control capabilities, including inspecting pages, executing JavaScript in browser contexts, navigating tabs, and interacting with authenticated websites. If the endpoint is reachable from the MCP server, disclosure can enable control over browser sessions. Even when it is not externally reachable, the value reveals internal network addressing and browser-control configuration.
The documentation compounds this risk by showing a plaintext
http://CDP URL inSKILL.md:21and claiming that the Skill enforces API-key authentication inSKILL.md:8, while the implementation sends no API key and con ...[truncated 1588 chars]- Remediation
View remediation
Remediation Suggestions
- Require
https:for every non-loopbackSERVER_URLand reject plaintext HTTP before constructing the transport. - Restrict MCP destinations to an explicit hostname and port allowlist. Display the resolved destination and require user approval before trusting a new server.
- Do not transmit a raw CDP endpoint to a remote service. Place browser access behind a local, authenticated broker that exposes narrowly scoped operations instead of unrestricted CDP.
- Bind CDP to loopback or a private interface, protect it with strong authentication, and prevent access from untrusted networks.
- Use short-lived, purpose-bound authorization tokens for MCP and browser operations. Do not treat
signinIdas sufficient authentication. - Validate MCP tool identities and schemas, and require confirmation for sensitive operations involving authenticated sessions, credential settings, purchases, or account changes.
- Avoid exposing sensitive headers through redirects. Configure the transport to reject cross-origin redirects or strip
x-cdp-urlandx-signin-idbefore following them. - Update
SKILL.mdto documentSERVER_URL, trusted-server requirements, transport-security requirements, CDP exposure risks, and the authentication mechanism actually implemented. - Remove the unsupported claim that API-key authentication is enforced unless authenticated requests are implemented and verified.
- Require