Security audit

BrowserMCP Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a real-browser automation skill, but it needs review because it uses authenticated browser sessions, promotes bot-detection avoidance, and installs an unpinned MCP server package.

Install only if you are comfortable giving the MCP server and Chrome extension control over connected tabs in your real browser profile. Prefer a dedicated Chrome profile, pin the npm package to a reviewed exact version, avoid global installation, and require explicit confirmation before logins, 2FA, purchases, posts, account changes, screenshots, or console-log collection on sensitive sites.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: templates/config-template.json:4
Finding: Execution of an Unpinned Remote npm Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (17)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · references/best-practices.md (reported line 496)May include surrounding context.
n observed load time snapshot() // Verify content loaded

text
### Batch Related Operations ```javascript // Group form field filling type(element="First name", ref="e5", text="John") type(element="Last name", ref="e6", text="Doe") type(element="Email", ref="e7", text="john@example.com") // Then single verification screenshot()

Security and Privacy

Understanding the Security Model

BrowserMCP Security Characteristics:

✅ Runs locally on user's machine

✅ Uses user's real browser profile

✅ No data sent to external automation servers

✅ Helps bypass basic bot detection

⚠️ Has access to user's logged-in sessions

⚠️ Can interact with sensitive accounts

Best Practices

User Consent: Always confirm with user before accessing sensitive sites

Session Awareness: Remember you're using their real login sessions

Data Sensitivity: Be careful with personal or financial data

CAPTCHA Respect: Don't try to bypass securi

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · references/best-practices.md (reported line 511)May include surrounding context.
md
1. **User Consent:** Always confirm with user before accessing sensitive sites 2. **Session Awareness:** Remember you're using their real login sessions 3. **Data Sensitivity:** Be careful with personal or financial data 4. **CAPTCHA Respect:** Don't try to bypass security measures aggressively ### Privacy Reminders for Users

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises use of the user's existing browser profile and authenticated sessions, but the top-level description does not clearly warn that automation may perform actions as the user, including submitting forms, changing account data, or triggering transactions. In this context, omission of an explicit consent/safety warning is dangerous because the skill is specifically designed to operate with live logged-in state and stealth capabilities, increasing the chance of high-trust unintended actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The privacy language says activity stays local and advises caution, but it does not concretely explain that the tool can expose sensitive authenticated content, form data, cookies-derived session access, and console logs that may contain tokens, personal data, or application secrets. Because this skill controls the real browser session, vague privacy wording understates the sensitivity of the data accessible through snapshots, screenshots, and logs.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The best-practices section includes entering 2FA codes via automation, which extends the tool from simple browser interaction into automated completion of a strong authentication step. Because BrowserMCP uses the user's real authenticated session, this can facilitate account access workflows on sensitive services and weakens the security boundary that 2FA is meant to reinforce.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation explicitly advertises bot-detection avoidance and guidance for handling CAPTCHA/rate-limiting scenarios. In the context of a browser automation skill that runs with the user's authenticated browser profile, this normalizes evasion of website security controls and can enable abuse of third-party services beyond ordinary automation needs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The statement that BrowserMCP 'helps bypass basic bot detection' directly promotes evasion of site security mechanisms. Even as documentation, this can encourage operators or downstream agents to use the skill for stealthy interactions against websites that are intentionally trying to distinguish human from automated access.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The setup instructs users to run an MCP server via npx using the @latest tag, which is effectively an unpinned remote code execution path. If the upstream package is compromised or a malicious version is published, users will execute attacker-controlled code locally through their MCP client.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This line tells users to install and run npx @browsermcp/mcp@latest, again relying on a moving package target. In the context of an MCP server with browser automation and access to authenticated sessions, a malicious update could gain broad access to browsing data and perform actions as the user.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The Claude Desktop configuration also references @browsermcp/mcp@latest, creating the same supply-chain risk through automatic execution by the MCP client. Because the tool is designed to control the user's real browser profile, compromise would be more dangerous than a typical utility package.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide explicitly promotes use of the user's existing Chrome profile and authenticated sessions without a clear warning about the security implications. In this skill context, that materially increases risk because the MCP server and extension can interact with logged-in sites, exposing personal data, tokens, and the ability to perform actions as the user.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation encourages navigation to arbitrary URLs and interaction with live websites without warning that doing so can transmit user data, trigger authenticated actions, or expose session state to third-party sites. Given the skill description explicitly mentions use of the user's existing browser profile, authenticated sessions, and stealth capabilities, this omission is more dangerous than in a sandboxed browser automation tool because actions may occur as the real user on real accounts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation explicitly encourages taking screenshots of the current browser viewport but does not warn that screenshots can capture sensitive data such as authenticated pages, personal information, tokens visible in the UI, or confidential business data. In this skill's context, the browser uses the user's existing profile and authenticated sessions, which materially increases the likelihood that captured images contain sensitive information and may be exposed to the agent or downstream systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The console log retrieval feature is documented as a general debugging tool without warning that browser logs often contain sensitive information, including URLs, API responses, error payloads, internal identifiers, and occasionally secrets or PII emitted by applications. Because this skill operates against the user's live browser session, log collection can expose private data from authenticated applications to the agent and any systems that store tool outputs.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/workflows.md (reported line 720)May include surrounding context.
md
### Data Privacy - Don't automate extraction of personal data without consent - Be cautious with screenshots containing sensitive info - Respect terms of service

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

SkillSpector

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

Security and Privacy

Understanding the Security Model

Best Practices

Instruction Override

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Context-Inappropriate Capability

Natural-Language Policy Violations

Rp1

Rp1

Rp1

Rp1

Rp1

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Autonomous Decision Making

Static analysis