T09 · Insecure Skill Coding Practices
Error
- Location
- script.js:9
- Finding
- Unrestricted MCP Server Receives the Browser CDP Endpoint and Sign-In Identifier## Vulnerability Details **File Location**: `script.js:9-19, 35-50` **Vulnerability Type**: Sensitive endpoint disclosure to an unrestricted remote service **Risk Level**: High ```js const SERVER_URL = process.env.SERVER_URL; const MCP_URL = `${SERVER_URL}/mcp`; const CDP_URL = process.env.CDP_URL; if (!CDP_URL) { throw new Error("CDP URL environment variable is required."); } if (!SERVER_URL) { throw new Error("SERVER URL environment variable is required."); } async function connectMcp(signinId) { // Disconnect if already connected to allow reconnection try { await mcpClient.close().catch(() => {}); } catch { // Ignore errors if not connected } const transport = new StreamableHTTPClientTransport(new URL(MCP_URL), { requestInit: { headers: { "x-signin-id": signinId ?? "", "x-incognito": "1", "x-cdp-url": CDP_URL, }, }, }); await mcpClient.connect(transport); } ``` ### Technical Analysis `SERVER_URL` is accepted directly from the environment and used without enforcing HTTPS, validating the destination against an allowlist, or requiring explicit approval for a new endpoint. The client then transmits both `CDP_URL` and `signinId` to that server as HTTP headers. A Chrome DevTools Protocol endpoint can provide extensive browser-control capabilities, including inspecting pages, executing JavaScript in browser contexts, navigating tabs, and interacting with authenticated websites. If the endpoint is reachable from the MCP server, disclosure can enable control over browser sessions. Even when it is not externally reachable, the value reveals internal network addressing and browser-control configuration. The documentation compounds this risk by showing a plaintext `http://` CDP URL in `SKILL.md:21` and claiming that the Skill enforces API-key authentication in `SKILL.md:8`, while the implementation sends no API key and con ...[truncated 1588 chars]
- Remediation
- ## Remediation Suggestions 1. Require `https:` for every non-loopback `SERVER_URL` and reject plaintext HTTP before constructing the transport. 2. Restrict MCP destinations to an explicit hostname and port allowlist. Display the resolved destination and require user approval before trusting a new server. 3. Do not transmit a raw CDP endpoint to a remote service. Place browser access behind a local, authenticated broker that exposes narrowly scoped operations instead of unrestricted CDP. 4. Bind CDP to loopback or a private interface, protect it with strong authentication, and prevent access from untrusted networks. 5. Use short-lived, purpose-bound authorization tokens for MCP and browser operations. Do not treat `signinId` as sufficient authentication. 6. Validate MCP tool identities and schemas, and require confirmation for sensitive operations involving authenticated sessions, credential settings, purchases, or account changes. 7. Avoid exposing sensitive headers through redirects. Configure the transport to reject cross-origin redirects or strip `x-cdp-url` and `x-signin-id` before following them. 8. Update `SKILL.md` to document `SERVER_URL`, trusted-server requirements, transport-security requirements, CDP exposure risks, and the authentication mechanism actually implemented. 9. Remove the unsupported claim that API-key authentication is enforced unless authenticated requests are implemented and verified.