Security audit

Browser Automation

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent browser-automation guide, but it teaches use of a real logged-in browser, credential entry, form submission, and arbitrary page JavaScript without strong enough safety boundaries.

Install only if you intend to let the agent automate browser actions and you understand the difference between sandbox browsing and your real browser session. Prefer sandbox mode for routine scraping or form tests. Do not allow host/user-browser use, login automation, arbitrary evaluate scripts, or account-changing clicks unless you are present and have explicitly approved the specific action.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill prominently advertises operation against the host machine and logged-in user browser but does not place an equally clear warning near the top that this can expose cookies, authenticated content, and sensitive account actions. In a browser automation context, lack of up-front safety framing makes dangerous use more likely because users may not distinguish sandbox browsing from access to their real session.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The login recipe demonstrates direct entry of a username and password into a host browser without an explicit secret-handling warning or approval boundary. This normalizes credential entry through the automation interface and could lead users or downstream agents to handle real secrets insecurely, especially in conjunction with screenshots, DOM snapshots, console access, or arbitrary evaluation.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The trigger phrases are broad and overlap with many normal browsing or scraping requests, increasing the chance that the skill activates in contexts where browser control was not intended. Because this skill can drive a real browser, submit forms, and access host/user sessions, accidental invocation materially raises the risk of unintended navigation, data access, or side effects.

Context Window Stuffing

Medium

Category: Memory Poisoning
Content: // 1. Navigate to form browser(action="navigate", target="sandbox", url="https://example.com/contact") // 2. Fill inputs browser(action="act", target="sandbox", ref="id:name", request={"kind": "fill", "text": "Alice Smith"}) browser(action="act", target="sandbox", ref="id:email", request={"kind": "fill", "text": "alice@example.com"}) browser(action="act", target="sandbox", ref="id:message", request={"kind": "fill", "text": "Hi, I'd like to know more..."})
Confidence: 85% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The example login flow instructs automation of real credential entry into the host/user browser session, which can expose secrets and enable privileged account actions if misused. In this skill's context, the danger is amplified because the same browser can access active sessions and subsequent actions can navigate, extract data, take screenshots, or submit forms under the user's identity.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill explicitly documents an `evaluate` action that accepts arbitrary JavaScript strings and executes them in the page context. While in-page JS execution is a legitimate browser automation feature, exposing it in a general-purpose skill significantly broadens capability to include DOM exfiltration, hidden form interaction, token harvesting from page state, and bypass of higher-level action safety constraints, especially when combined with `host` or user-session browsing.

Intent-Code Divergence

Low

Confidence: 93% confidence
Finding: The introductory documentation states that using the logged-in user browser is done with `profile="user"`. However, the concrete login example switches to `target="host"` and never uses `profile="user"`, which gives conflicting guidance about how user-session automation is actually selected.

Static analysis

No suspicious patterns detected.