Security audit
Security checks for vulnerabilities and agentic risk
PinchTab is a coherent local browser automation skill, but users should treat it as powerful because it can control Chrome, read page content, and use persisted browser sessions.
Install only if you intend to let an agent control a Chrome browser. Use a fresh dedicated PinchTab profile, keep the API bound to 127.0.0.1, set BRIDGE_TOKEN before any network exposure, avoid daily or password-filled Chrome profiles, and treat screenshots, snapshots, raw text, and eval output as sensitive data.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
如果怀疑安全事件：
1. 停止 PinchTab：`pkill pinchtab`
2. 删除配置文件：`rm -rf ~/.pinchtab/automation-profile`
3. 更改所有可能泄露的密码
4. 检查浏览器扩展和保存的密码
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
如果怀疑安全事件：
1. 停止 PinchTab：`pkill pinchtab`
2. 删除配置文件：`rm -rf ~/.pinchtab/automation-profile`
3. 更改所有可能泄露的密码
4. 检查浏览器扩展和保存的密码
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
}
### DELETE /tabs/{id}
关闭标签页。
Although the command is scoped to a profile directory, it is still a powerful destructive filesystem operation shown in documentation with no safeguards or validation steps. In a browser automation tool that stores cookies, local storage, history, and potentially passwords in profiles, accidental execution against the wrong path could lead to permanent data loss or operational disruption.
# 删除配置文件
rm -rf ~/.pinchtab/work-profile
Although the command is scoped to a profile directory, it is still a powerful destructive filesystem operation shown in documentation with no safeguards or validation steps. In a browser automation tool that stores cookies, local storage, history, and potentially passwords in profiles, accidental execution against the wrong path could lead to permanent data loss or operational disruption.
# 删除配置文件
rm -rf ~/.pinchtab/work-profile
The manifest description and the full skill guide are presented in Chinese, and the file does not indicate that language selection is optional or that the skill is intentionally limited to Chinese-speaking users. Under the policy for natural-language violations, forcing a specific language without user opt-in is in scope for all file types.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST http://localhost:9867/navigate \
-H "Content-Type: application/json" \
-d '{"url": "https://example.com"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
导航后等待 3 秒再快照：
curl -X POST http://localhost:9867/navigate \
-H "Content-Type: application/json" \
-d '{"url": "https://example.com"}' && \
sleep 3 && \
/snapshot、/text、/screenshot 这类读取型端点能够导出页面内容、可访问性树和视觉信息，但文档未提醒其可能暴露密码重置页面、个人资料、内部系统数据、Cookie 相关界面信息或其他敏感内容。在该技能的上下文中，工具专门用于自动化控制浏览器，因此这些端点天然具备高数据收集能力，风险高于普通只读 API。
文档公开描述了 /eval 可在浏览器上下文中执行任意 JavaScript，但没有任何风险提示、权限边界、适用范围或示例限制。对于一个可被代理/自动化系统调用的本地浏览器控制 API，这意味着调用方可读取页面 DOM、提取令牌/表单数据、触发敏感操作，甚至借助已登录会话执行账户级行为。
The documentation includes a destructive rm -rf profile deletion command without an explicit warning that it permanently removes browser state such as cookies, local storage, history, and possibly saved credentials. In operational or copied-and-pasted use, users may delete the wrong profile or lose important data unintentionally.
This markdown file is natural-language documentation, and all user-facing content is presented only in Chinese. Under the policy rule for language/locale constraints, this can be a violation when the skill does not offer an opt-in language choice or justify that the documentation is intended only for a Chinese-speaking or region-specific audience.
All user-facing natural-language content in this file is presented in Chinese, with no indication that the skill is intentionally region-specific or that users may select another language. This can violate language/locale policy when a skill forces a specific language without user opt-in.