Security audit

Browser Automation

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real browser automation helper, but it needs review because it runs an unsandboxed browser against arbitrary URLs and installs Puppeteer without a pinned dependency set.

Install only in an isolated, unprivileged environment with limited network access, do not expose secrets or internal services to the browser process, require explicit user confirmation before submitting forms or using credentials/cookies, restrict allowed URL targets where possible, and pin Puppeteer with a reviewed lockfile before production use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/scrape.js:15
Finding: Unrestricted Browser Navigation Enables Server-Side Request Forgery
Content: View full analysis
[selector]'); console.error('Example: node scrape.js https://example.com h2'); process.exit(1); } (async () => { const browser = await puppeteer.launch({ headless: 'new', args: ['--no-sandbox', '--disable-setuid-sandbox'] }); const page = await browser.newPage(); // Set a neutral user agent await page.setUserAgent('Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36'); console.error(`Fetching: ${url}`); await page.goto(url, { waitUntil: 'networkidle2', timeout: 30000 }); ``` `scripts/crawl.js:15-50`: ```javascript const url = process.argv[2]; const selector = process.argv[3]; const maxPages = parseInt(process.argv[4]) || 10; if (!url || !selector) { console.error('Usage: node crawl.js [maxPages]'); console.error('Example: node crawl.js https://example.com/products .item 5'); process.exit(1); } (async () => { const browser = await puppeteer.launch({ headless: 'new', args: ['--no-sandbox', '--disable-setuid-sandbox'] }); const page = await browser.newPage(); // Set a neutral user agent await page.setUserAgent('Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36'); let allData = []; for (let i = 1; i <= maxPages; i++) { // Build page URL - append ?page=X or &page=X let pageUrl = url; if (i > 1) { pageUrl = url.includes('?') ? `${url}&page=${i}` : `${url}?page=${i}`; } console.error(`[${i}/ ...[truncated 3321 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/scrape.js:24
Finding: Chromium Sandbox Is Explicitly Disabled for Untrusted Web Content
Content: View full analysis
{ const browser = await puppeteer.launch({ headless: 'new', args: ['--no-sandbox', '--disable-setuid-sandbox'] }); ``` `scripts/crawl.js:25-29`: ```javascript (async () => { const browser = await puppeteer.launch({ headless: 'new', args: ['--no-sandbox', '--disable-setuid-sandbox'] }); ``` `scripts/screenshot.js:26-30`: ```javascript (async () => { const browser = await puppeteer.launch({ headless: 'new', args: ['--no-sandbox', '--disable-setuid-sandbox'] }); ``` The same unsafe configuration is also promoted in `SKILL.md:42-45`, `README.md:92-95`, and `references/puppeteer-api.md:7-18`. ### Technical Analysis The `--no-sandbox` and `--disable-setuid-sandbox` flags explicitly disable Chromium's process sandbox. This sandbox is a major isolation boundary intended to limit the operating-system resources available to compromised renderer processes. The skill is specifically designed to load caller-selected websites, meaning Chromium routinely processes arbitrary and potentially malicious HTML, JavaScript, images, fonts, and other complex content. Disabling the sandbox substantially increases the consequences of a Chromium renderer vulnerability: an exploit that would otherwise remain constrained within a sandboxed renderer may gain the privileges of the Node.js/Chromium process. The configuration does not independently create code execution; exploitation requires a compatible browser vulnerability or another renderer compromise. However, it removes an important defense-in-depth boundary from a high-risk use case involving untrusted remote content. The API reference states that `--no-sandbox` is required for Linux, which is o ...[truncated 1493 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:5
Finding: Unpinned Puppeteer Installation Creates a Non-Reproducible Supply Chain
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger language is broad enough to match many generic requests involving browsing, screenshots, data extraction, or page interaction, which can cause this skill to activate in situations where a less powerful or safer skill would be more appropriate. Because this skill performs live browser automation and can interact with third-party sites, over-selection increases the chance of unintended network access, scraping, form submission, or local file creation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill does not clearly warn that using it will initiate live requests to external websites, may fill and submit forms, and may save screenshots or scraped content locally. In an agent setting, missing this disclosure makes it easier for users or higher-level planners to invoke powerful browser actions without appreciating the privacy, consent, and side-effect risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file includes an example that sets an Authorization header with a bearer token, which is a network operation involving credentials. The surrounding documentation provides no warning that requests may transmit sensitive authentication data or that users should handle tokens carefully.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The documentation shows reading and setting cookies, including a session cookie value, which can affect privacy and authentication state. There is no user-facing warning that cookie operations may expose or modify sensitive session data.
Content: No source excerpt is available for this finding.