ClawHub
Back to skill

Security audit

Chrome DevTools Web Research

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate browser-research helper, but it asks for broad access to the user's live Chrome session and uses unpinned install/runtime packages without enough scoping safeguards.

Install only if you are comfortable giving the agent DevTools-level access to a Chrome session. Use a separate temporary Chrome profile with no unrelated logged-in accounts, close unrelated tabs, pin/review the npm package versions where possible, and disable remote debugging when finished.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:121
Finding

Unpinned npm Packages Permit Mutable Third-Party Code Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8 and 121–130
Vulnerability Type: Unpinned third-party dependencies and unsafe package execution
Risk Level: Medium

Vulnerable Code

markdown
Use `chrome-devtools-mcp@latest` through `mcporter` to drive Chrome, inspect real pages, and extract structured findings from dynamic websites.
markdown
Expect a `chrome-devtools` server using a transport similar to:

```text
STDIO npx chrome-devtools-mcp@latest --autoConnect

If mcporter is missing, help the user install it first. If the chrome-devtools MCP server is missing, help the user configure or install it instead of stopping at a vague error.

Practical install/remediation flow:

bash
npm i -g mcporter

Technical Analysis

The Skill explicitly directs users or agents to retrieve and execute chrome-devtools-mcp@latest through npx. The latest tag is mutable and can resolve to a different release each time the command runs. The global installation of mcporter is likewise unpinned. No lockfile, integrity hash, exact version constraint, trusted registry restriction, or package provenance verification is specified.

npm package execution can invoke package runtime code and, depending on npm configuration, installation lifecycle scripts. Consequently, the code that executes is not the same immutable content that was available during this audit. A compromised maintainer account, malicious package release, registry compromise, or compromised transitive dependency could introduce arbitrary local code into this workflow.

Attack Path

  1. An attacker compromises the npm account, release process, registry entry, or dependency chain associated with chrome-devtools-mcp or mcporter.
  2. The attacker publishes a malicious version and assigns it to the latest tag, or causes the unversioned installation to resolve to the compromised release.
  3. A user or agent follo ...[truncated 1000 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest and unversioned installation commands with exact, reviewed package versions.
  2. Maintain a lockfile containing package integrity metadata and review changes before upgrades.
  3. Pin both direct and transitive dependencies where the deployment mechanism permits.
  4. Use a trusted npm registry and enforce package provenance or signature verification.
  5. Prefer a project-local installation over a global installation to reduce scope.
  6. Disable npm lifecycle scripts during installation where they are unnecessary, then explicitly enable only reviewed behavior.
  7. Execute browser automation tooling in a sandbox, container, or dedicated low-privilege account.
  8. Establish a controlled update process that audits new versions before changing the pinned dependency.

T05 · Unauthorized Access and Privilege Escalation

Note
Location
SKILL.md:16
Finding

Remote Debugging Guidance Exposes Broad Authenticated Browser State

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–20
Vulnerability Type: Excessive access to authenticated browser sessions
Risk Level: Low

Vulnerable Code

markdown
If the user needs to enable tab access in Chrome, give them this short setup flow:

1. Open `chrome://inspect/#remote-debugging`
2. Toggle it on
3. That’s it — the agent can now see the user’s tabs, cookies, logins, and page state through Chrome DevTools MCP

Technical Analysis

The setup procedure instructs the user to enable Chrome remote debugging for a browser session that may contain unrelated authenticated tabs, cookies, login state, and sensitive page content. This creates access broader than is normally required for a specific web-research task.

The Skill acknowledges the breadth of access but does not require a dedicated browser profile, removal of unrelated tabs, isolation from the user's primary profile, origin restrictions, or explicit task-scoped authorization for authenticated browsing. Chrome DevTools access is highly privileged within the connected browser context and may permit inspection or manipulation of pages using the user's existing sessions.

No instruction to steal credentials or exfiltrate browser data was found. The risk arises from the excessive privilege boundary created by the recommended configuration, particularly when combined with mutable third-party tooling.

Attack Path

  1. The user opens their normal Chrome profile, which contains authenticated sessions and unrelated sensitive tabs.
  2. Following the Skill instructions, the user enables remote-debugging access.
  3. Chrome DevTools MCP attaches to the browser and gains visibility into tabs, login-aware page state, and other exposed session data.
  4. A compromised MCP dependency, malicious automation action, or erroneous agent operation selects a tab or origin unrelated to the requested research.
  5. Sensitive content is read, manipulat ...[truncated 552 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require a dedicated, temporary Chrome profile for MCP-driven research.
  2. Instruct users to close unrelated tabs and sign out of services not required for the task.
  3. Use a separate low-privilege browser account without access to primary personal or administrative sessions.
  4. Obtain explicit consent before accessing any authenticated website or sensitive page state.
  5. Restrict navigation and inspection to task-relevant origins wherever tooling supports allowlists.
  6. Disable remote debugging immediately after completing the task.
  7. Clearly warn users that remote-debugging access may expose authenticated content, rather than presenting enablement as a consequence-free toggle.
  8. Run the MCP bridge in an isolated environment and combine it with pinned, reviewed dependencies.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation description is extremely broad and pushes the skill to engage for many ordinary research tasks, increasing the chance that browser automation is invoked when lower-risk tools would suffice. In this context, overbroad triggering is dangerous because the skill immediately escalates to live browser access with visibility into sensitive authenticated state.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly instructs enabling access to the user's tabs, cookies, logins, and page state, but it does not require meaningful consent, scope limitation, or a privacy warning proportional to that access. This can expose session tokens, authenticated content, and other sensitive browser data far beyond what is necessary for routine web research.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
97% confidence
Finding

The text normalizes access to browser cookies, logins, and page state, which are common information-stealer targets. Even if framed as research tooling, combining proactive activation with remote-debugging access to authenticated browser context creates a serious data-exposure pathway if misused or if the MCP chain is compromised.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

se MCP first by default. Do not wait for the user to remind you to use it.

For concrete failure wording and remediation paths, read references/troubleshooting.md.

User setup guidance

If the user needs to enable tab access in Chrome, give them this short setup flow:

  1. Open chrome://inspect/#remote-debugging
  2. Toggle it on
  3. That’s it — the agent can now see the user’s tabs, cookies, logins, and page state through Chrome DevTools MCP

Explain plainly that this uses Chrome DevTools MCP under the hood and does not require a browser extension.

Quick start

  1. Verify the MCP server is available.
  2. Open the target page with chrome-devtools.new_page.
  3. Take a snapshot and read visible structure from the accessibility tree.
  4. Navigate, click, fill, or switch tabs as needed.
  5. Cross-check important claims across multiple sources.
  6. Close pages promptly when a search leg is done.
  7. Summarize by source quality, not page volume.

Core commands

bash

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
5. If Google is blocked by captcha, consent wall, or anti-bot friction, **do not stall**. Record that Google was blocked and continue to **X**, then **Reddit**.
6. Only stop the flow when the browser bridge is clearly broken and the user must intervene.

Practical rule: prefer **one immediate retry + one environment re-check + one resumed attempt**. Do not loop endlessly.

### Default search strategy

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · references/troubleshooting.md (reported line 118)May include surrounding context.

md
5. If Google is blocked by captcha, consent wall, or anti-bot friction, **do not stall**. Record that Google was blocked and continue to **X**, then **Reddit**.
6. Only stop the flow when the browser bridge is clearly broken and the user must intervene.

Practical rule: prefer **one immediate retry + one environment re-check + one resumed attempt**. Do not loop endlessly.

### Default search strategy

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill references npx chrome-devtools-mcp@latest/an unpinned MCP server, which permits silent upstream code changes at runtime. That creates a supply-chain risk: a compromised or incompatible newer release could gain browser-level access and operate against the user's authenticated session.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.