chrome-cdp-controller

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:57 AM UTC
• Version: 1.0.0

Overview

This is a real Chrome automation skill, but it gives agents broad control over a live browser session without enough safety warnings or containment.

Install only if you are comfortable giving the agent control of a Chrome instance. Use a separate Chrome profile with no sensitive logins, keep the DevTools port bound to localhost, close it when finished, avoid interception on private sites, and update dependencies before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

Known Vulnerable Dependency: basic-ftp==5.1.0 — 4 advisory(ies): CVE-2026-27699 (Basic FTP has Path Traversal Vulnerability in its downloadToDir() method); GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more

Critical

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The lockfile pins basic-ftp 5.1.0, which is reported as affected by multiple advisories including path traversal, CRLF/command injection, and denial-of-service issues. In this skill, basic-ftp is only an indirect dependency via get-uri/pac-proxy-agent/proxy-agent and is not obviously part of the primary browser-control workflow, so exploitability depends on whether untrusted FTP or PAC-related inputs are ever processed; nevertheless, keeping a known-vulnerable package is unsafe.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

extract-zip 2.0.1 is flagged for arbitrary file write and symlink path traversal issues during archive extraction. In this dependency graph it is used by @puppeteer/browsers, and while this skill targets existing local Chrome instances, any code path that downloads or extracts browser archives from untrusted or tampered sources could lead to filesystem overwrite outside the intended directory.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

ip-address 10.1.0 is listed with advisories involving ambiguous IPv4 parsing and XSS in HTML-emitting Address6 helpers. Here it is a transitive dependency of socks/socks-proxy-agent, and unless the skill exposes proxy parsing or renders library-generated HTML into a UI, the practical risk is limited; however, the package version is still known-vulnerable.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

ws 8.19.0 is a real concern in this skill because Puppeteer communicates with Chrome DevTools Protocol over WebSocket, making ws part of the core runtime path rather than an unused transitive package. The cited issues include memory disclosure and memory-exhaustion DoS, so a malicious or compromised WebSocket peer, or exposure to hostile CDP endpoints, could destabilize the process or leak process memory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly supports intercepting network responses from an already logged-in local Chrome session, but it does not warn that intercepted traffic may include authentication tokens, personal data, API responses, or other sensitive session content. In this context, omission of that warning is dangerous because users may treat interception as routine scraping/debugging while unknowingly exposing highly sensitive browser-session data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow encourages use of evaluate to execute arbitrary JavaScript inside an existing Chrome session without warning that this can act with the privileges of logged-in sites, modify page state, trigger transactions, extract data, or alter account settings. Because the skill attaches to the user's live browser rather than an isolated sandbox, this omission materially increases the risk of harmful actions against real accounts and active sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document instructs users to launch Chrome with a remote debugging port but does not warn that CDP exposes full browser control and access to session data, cookies, page contents, and authenticated actions to any client that can reach that port. In the context of a browser-control skill, this omission is more dangerous because users are being actively guided to enable a highly privileged interface that could be abused locally or, if bound or forwarded improperly, remotely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file documents a start_intercept action for *graphql* traffic and a get_intercepted action, which could capture user or system data from web sessions. The surrounding documentation provides no warning about privacy, consent, or handling of sensitive intercepted content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The interception feature stores full response bodies, headers, status, and URLs for matching requests, which can capture session data, personal information, CSRF tokens, API responses, and other secrets from the controlled browser session. In this skill’s context, that is materially risky because CDP automation is explicitly designed to interact with authenticated web apps and monitor network traffic, so the feature can easily collect sensitive data beyond the user’s immediate intent.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency uses a caret range (^23.0.0), which permits automatic installation of newer minor and patch releases rather than a single fixed version. This increases supply-chain risk because builds are not fully reproducible and a compromised or breaking upstream release of puppeteer-core could be pulled into an environment that controls a local Chrome instance via CDP.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"author": "",
  "license": "MIT",
  "dependencies": {
    "puppeteer-core": "^23.0.0"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

All natural-language instructions in the file are in Chinese, which imposes a language constraint without any opt-in or explanation. Per the policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale limitation is clearly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instructions use forceful process termination commands such as killall/taskkill without warning that this will close all Chrome windows and may discard unsaved form input, downloads, or ongoing work. This is primarily a safety and usability issue rather than a direct security flaw, but it can still cause unintended disruption on the user's system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file title and all instructional content are presented in Chinese, with no indication that this language choice is optional or required for a region-specific purpose. This can violate a language/locale policy when the skill does not offer user opt-in or an alternative language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The screenshot example explicitly saves a file to /path/to/screenshot.png, which affects user data/storage and may capture sensitive on-screen information. The documentation does not disclose that a local file will be created or caution users about sensitive content in screenshots.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Nearly all user-visible status, error, and usage messages are written in Chinese, and the file does not provide any option to select another language or state that the tool is intended only for a Chinese-speaking environment. This creates a natural-language locale policy issue because the skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.