Js Eyes

• Outcome: Review
• Latest audit: Jul 19, 2026 · 10:51 AM UTC
• Version: 2.8.4

Overview

This is a powerful local browser automation skill with disclosed setup steps, but it enables high-risk browser access and startup persistence with weaker user-control guarantees than the instructions imply.

Install only if you intend to give JS Eyes broad control over a locally connected browser, including page scripting and cookie access. Prefer setting security.allowRawEval=false unless a specific workflow requires it, review security.toolPolicies, consider disabling Native Messaging autoInstall/repair unless needed, and treat linked extraSkillDirs or registry-installed skills as executable local code.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (35)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions while instructing use of shell commands, environment-variable-based config resolution, local file edits, and networked components. That mismatch weakens review and consent boundaries because an operator may treat the skill as low-risk even though it can install software, alter persistent config, and expose automation capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The description frames the skill as install/configure/troubleshoot guidance, but the body enables a much broader browser-automation and skill-loading platform, including raw script execution, cookie access, remote skill acquisition, and local child-process execution. That scope expansion is security-relevant because users may approve the skill for administrative setup while unknowingly enabling a general-purpose automation and code-loading surface.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly directs operators to set `security.allowRawEval: true` as part of the default deployment, even though the document admits this is an insecure posture and that a safer mode exists. Enabling raw JavaScript evaluation broadens the attack surface from configuration assistance into arbitrary script execution in the automation context, which can facilitate data access, session abuse, and privilege misuse.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill instructs default-enabling a large set of bundled extension skills unrelated to minimal base installation. This unnecessarily expands the active capability set and increases the chance that sensitive actions, platform-specific automation, or future bugs in those skills become reachable without deliberate operator choice.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill exposes arbitrary JavaScript execution inside any targeted browser tab via user-supplied code. In the context of a plugin whose stated purpose is installing, configuring, verifying, and troubleshooting JS Eyes, this capability is overbroad and can be abused to read page data, alter transactions, harvest tokens from page context, or perform actions as the logged-in user.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The action returns all cookies for the tab's domain directly to the caller, which can expose session cookies and authentication material. This is sensitive browser data unrelated to normal install/configure/troubleshoot flows, so the capability materially increases the risk of account takeover and data theft.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This action broadens access further by allowing domain-wide cookie enumeration without even tying access to an active tab. That enables targeted harvesting of authentication cookies across arbitrary sites and is especially dangerous because it bypasses any implicit constraint of current page context.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Uploading arbitrary Base64-provided files into web pages gives the skill a general-purpose ability to submit attacker-controlled content into third-party sites. While less directly sensitive than cookie theft or script execution, it can still be abused for unwanted actions, exfiltration workflows, or misuse of authenticated web applications.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest enables automatic native host installation and repair by default via `nativeHost.autoInstall` and `repairStale`, including possible writes to manifests, launchers, or the Windows registry. This is security-sensitive because it grants the plugin self-deployment behavior into browser/native messaging trust paths, increasing the risk of persistence, privilege abuse, or silent host reconfiguration if the plugin is compromised or misused.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest enables automatic native host installation and repair by default via `nativeHost.autoInstall` and `repairStale`, including possible writes to manifests, launchers, or the Windows registry. This is security-sensitive because it grants the plugin self-deployment behavior into browser/native messaging trust paths, increasing the risk of persistence, privilege abuse, or silent host reconfiguration if the plugin is compromised or misused.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The tool is presented as a JS Eyes installation/troubleshooting skill, but its description explicitly advertises broad routing to browser, skills, and security-management actions. This creates a capability/intent mismatch that can mislead users or higher-level policy systems and enables use of privileged functions outside the declared purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The dispatcher executes any matching core action and forwards any `skill/<skillId>/<action>` request to the skill registry without validating that the action belongs to JS Eyes support. That effectively turns this skill into a generic capability router, bypassing least-privilege expectations for a narrowly scoped support skill.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Advertising `security/reload` and similar security-management routes from a JS Eyes support tool grants access to sensitive administrative capabilities unrelated to the stated purpose. In the context of a browser automation helper, exposing security controls is especially dangerous because it widens privilege and may permit disabling, reloading, or interfering with protections.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code allows arbitrary cross-skill action execution through `skillRegistry.executeAction(normalizeSkillAction(action), ...)`, enabling this skill to invoke other skills' functionality without visible per-skill authorization checks here. For a JS Eyes-specific support skill, that unjustified lateral access increases the risk of privilege escalation and misuse of unrelated capabilities.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This WebSocket handler exposes a broad remote browser-control surface including URL navigation, script/CSS injection, cookie access, and file upload. That capability set materially exceeds the stated skill purpose of install/configure/verify/troubleshoot, increasing the chance the skill can be used as a general-purpose browser exploitation and data-access channel rather than a narrowly scoped support tool.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The handler supports get_cookies and get_cookies_by_domain, enabling extraction of authentication cookies and other session material from browser contexts. In a skill whose declared purpose is setup/troubleshooting, this is unjustified high-risk access that can enable account takeover, session hijacking, and privacy violations if an automation client is compromised or over-privileged.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The execute_script/inject_script and inject_css actions allow arbitrary code and style injection into browser tabs, which can manipulate page behavior, read page content, trigger transactions, or exfiltrate data from active sessions. Because the skill context is only installation and troubleshooting, exposing arbitrary in-tab execution is especially dangerous and suggests the component can be repurposed for offensive browser automation.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Upload-file and screenshot-capture capabilities provide additional access to local data entry workflows and page contents that are not clearly necessary for installation/configuration support. These features can be abused to submit files into web apps or capture sensitive on-screen information from authenticated sessions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill directs the agent to modify persistent user configuration files (`openclaw.json` and `~/.js-eyes/config/config.json`) and restart services without an explicit user-impact warning or confirmation checkpoint. Silent persistence changes are risky because they can alter future tool exposure, autostart behavior, and security settings beyond the immediate task.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The cookie retrieval action exposes highly sensitive authentication data yet provides no user-facing warning, confirmation step, or indication of the risk. That lack of guardrails makes accidental or covert extraction of browser secrets much more likely.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Enumerating cookies for arbitrary domains without an explicit safety warning or confirmation creates a covert channel for extracting browser secrets at scale. Because the action is not obviously constrained to a safe support workflow, the absence of notice significantly increases abuse potential.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: Executing arbitrary JavaScript in a live browser tab can read sensitive page state, manipulate DOM content, trigger authenticated actions, and alter user workflows. Without any explicit warning or confirmation to the user, this becomes a high-risk silent execution primitive.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The wrapper treats tools marked with policy='confirm' as implicitly approved: it records an 'auto-confirm' decision, logs a warning, and then immediately executes the sensitive tool. This defeats the stated confirmation control, creating a policy-bypass condition where operations intended to require user consent are silently allowed, which is especially risky in a browser automation/plugin context that may perform external actions or access sensitive resources.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The default server URL uses plain `ws://`, while the client may include the authentication token both as a query parameter and as a bearer token/subprotocol during connection setup. If used over a non-loopback or untrusted network, this can expose credentials to interception and allow unauthorized access to the browser automation service.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Sensitive browser actions are forwarded to the extension directly once invoked, and this file shows no user-facing confirmation or consent flow for operations such as script execution, cookie access, or file upload. Even with backend policy checks, absence of an explicit user approval step increases the risk of stealthy misuse by any connected automation client or by mistakes in policy configuration.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: packages/protocol/safe-npm.js:91

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: packages/protocol/skill-runner.js:39

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: packages/protocol/tests/safe-npm.test.js:43