Security audit

Browser Control

Security checks across malware telemetry and agentic risk

Overview

This skill has a coherent remote-browser purpose, but it exposes high-impact browser/desktop access and under-discloses how sensitive the access link and session control are.

Install only if you explicitly want an agent-assisted remote browser/desktop session for sensitive login workflows. Treat the noVNC link as a secret, prefer a dedicated browser profile or limited account, stop the tunnel immediately after use, and remove any saved access URLs from workspace files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes shell commands, reads local files, writes configuration files, and establishes network tunnels, but it does not declare those capabilities to the platform. That creates a transparency and policy-enforcement gap: users or higher-level controls may approve the skill believing it has narrower powers than it actually uses.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior materially understates the risk surface. This skill does more than provide a temporary browser-login handoff: it exposes a remote desktop-style session over the internet, enables Chrome remote debugging for programmatic browser control, stores an access URL containing the VNC password, and relies on an external verification service, all of which increase the chance of credential theft, session hijacking, or broader host/browser compromise.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The installer launches Chrome/Chromium with --remote-debugging-port=9222 and later records a cdpUrl in config.json, which materially expands the skill from manual browser sharing into full programmatic browser control. CDP access can inspect pages, cookies, local storage, and automate interactions, making it far more sensitive than the advertised manual-login-only workflow.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The generated noVNC URL includes the VNC password in the query string, so anyone who sees logs, chat history, browser history, screenshots, referer leaks, or copied links can recover the credential. This undermines the claim that only the configured email can access, because possession of the URL also grants the embedded VNC secret once OAuth is passed or if the link is mishandled.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The user-facing instructions encourage sharing a live access link without clearly warning that it grants interactive control over the active browser/desktop session and may reveal credentials, cookies, 2FA prompts, or other sensitive on-screen data. In a login and MFA context, omission of that warning meaningfully increases the risk of unsafe user behavior and uninformed consent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The installer sends a user-provided verification code to a third-party service and receives the user's email address, but the script gives no meaningful privacy disclosure, trust boundary explanation, or retention details. For a skill handling login and verification workflows, silently outsourcing identity verification increases data exposure and creates dependency on an external service outside the local installer's control.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The script appends the VNC password as a query parameter in a public noVNC URL, then prints and persists that URL to config.json and TOOLS.md. Query-string secrets are easily exposed through shell history, logs, screenshots, copied messages, browser history, referrer leakage, and any process or user that can read those files, which can allow unauthorized remote desktop access if the URL is shared or intercepted. The skill context increases risk because it is explicitly designed for login, MFA, captcha, and other highly sensitive browser sessions.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal