Security audit
Security checks for vulnerabilities and agentic risk
This skill is a browser-control tool whose core behavior is disclosed, but it gives an agent broad CDP control, arbitrary page JavaScript execution, and background browser access with limited guardrails.
Install only if you intentionally want an agent to control a local browser through CDP. Avoid using it on sensitive logged-in accounts unless you explicitly approve each action, close the detached browser when finished, and treat eval/source/snapshot/screenshots as able to expose private page content.
The script clearly performs network operations against a local Chrome DevTools Protocol endpoint via HTTP and WebSocket, but the metadata does not declare that capability. This is dangerous because the tool can open pages, read page content, and execute JavaScript in the browser, which materially expands its power beyond what an undeclared-permissions model would imply.
The skill explicitly exposes an eval <id> "<js>" capability that allows arbitrary JavaScript execution in whatever page context is open, but it provides no warning, restriction, or approval requirement around side effects. In a browser automation skill, this can trigger state-changing actions such as form submission, account changes, destructive clicks, or data exfiltration from the currently authenticated session, making misuse materially more dangerous than read-only navigation.
The documented commands allow reading page text, dumping full HTML, and executing arbitrary JavaScript in the active browser context without any explicit safety notice. In context, this is particularly sensitive because the browser may hold authenticated sessions, making content extraction and JS-driven actions capable of accessing or mutating user data on logged-in sites.
The screenshot command writes binary data to any user-supplied filesystem path with no guardrails or warning. While this is expected CLI behavior, in an agent-skill context it enables silent local file creation or overwrite, which can damage files or place sensitive browser-derived content in unsafe locations.
All user-facing usage text, examples, and status/help messages in the file are presented in Chinese only. This can violate language/locale policy when the skill forces a specific language without offering the user an alternative or making the constraint explicit.
No suspicious patterns detected.
