Security audit

Real Browser Qa Ceki Main

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate real-browser QA purpose, but it also includes under-scoped third-party account automation, CAPTCHA delegation, sensitive session persistence, and risky installation behavior that require Review before use.

Install only after reviewing and constraining it to owned or explicitly authorized sites. Avoid marketplace mode for credentials, production data, internal systems, payments, or private content; do not use the bundled third-party signup/CAPTCHA workflows; prefer a pinned SDK in a virtual environment; and store any exported browser profiles in a private encrypted location or avoid exporting them entirely.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:158
Finding: Mandatory Disclosure of Browser Task Details to an External Service
Content: View full analysis
" \ --status 100 --type 2 \ --benefitable agent:N --desc "Task: Plan: 1. Rent browser 2. Navigate to target 3. ..." # Note the returned event_id (eid), then: ceki timelog start ``` When the session completes: ```bash ceki contract progress --status 222 --desc "Done: " ceki timelog stop --label "Completed browser session" ``` ``` ### Technical Analysis The Skill requires an agent to register every browser task on the Ceki server before performing the requested work. The transmitted fields include the task label, description, plan, and completion result. Server-side task registration is not technically necessary for the core functionality of opening and controlling a remote browser. Making it mandatory expands the data disclosed to the provider beyond the minimum required session metadata. Depending on how an agent fills the templates, the data may include internal URLs, customer names, test credentials, vulnerability hypotheses, planned security-testing actions, or other confidential context. The instruction also changes the agent's execution workflow by directing it to perform an external side effect before the user's browser task. This behavior is not clearly presented as optional or conditioned on explicit user consent. ### Attack Path 1. A user asks the agent to test an internal or sensitive web application. 2. The agent loads the Skill and follows its mandatory pre-flight instr ...[truncated 976 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: install.sh:7
Finding: Unpinned Third-Party Package Installation into the System Python Environment
Content: View full analysis
/dev/null 2>&1; then pip3 install --upgrade ceki-sdk --break-system-packages 2>/dev/null \ || pip3 install --upgrade --user ceki-sdk elif command -v pip >/dev/null 2>&1; then pip install --upgrade ceki-sdk --break-system-packages 2>/dev/null \ || pip install --upgrade --user ceki-sdk else ``` Related Skill instructions also recommend: ```bash pip install --upgrade ceki-sdk --break-system-packages ``` ### Technical Analysis The installer retrieves the latest available `ceki-sdk` package without pinning a reviewed version or verifying package hashes. Consequently, the effective code installed by the Skill may change after the Skill itself has been audited. The first installation attempt uses `--break-system-packages`, bypassing Python's externally managed environment protection. If the executing user has sufficient write permissions, this can alter the system Python environment and replace existing dependencies. If that attempt fails, the script falls back to an unpinned user-level installation. Python packages and their dependencies can run code during installation and whenever their installed entry points are executed. A compromised publisher account, malicious dependency update, or unexpected upstream release could therefore execute code with the privileges of the user running the installer. Redirecting the first installation attempt's standard error to `/dev/null` also suppresses security-relevant diagnostics and makes failures or dependency conflicts harder to review. ### Attack Path 1. An attacker compromises the package publisher, package index account, or a transitive dependency. 2. The attacker publishes a malicious release that satisfies the unpinned package name. 3. A us ...[truncated 1158 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:654
Finding: Authentication Cookies and Browser Storage Exported to a Predictable Temporary File
Content: View full analysis
export | -o PATH | JSON with cookies+storage+fingerprint ``` ### Technical Analysis The profile export contains cookies, web storage, and browser fingerprint data. Authentication cookies and storage tokens can function as bearer credentials and may allow an attacker to reuse an authenticated session without knowing the account password or completing MFA again. The instructions write this data to the fixed path `/tmp/profile.json`. On multi-user systems, `/tmp` is normally a shared namespace. A predictable filename introduces several risks: - Another local user or process may attempt to read the file if permissions are insufficient. - Existing data can be overwritten or unintentionally reused. - A pre-created file or symbolic link may redirect output if the CLI does not safely create files. - The sensitive profile remains after use because the instructions do not delete it. - Backup, diagnostic, or cleanup processes may collect the plaintext file. The exact exploitability of symbolic links and cross-user reads depends on the SDK's file-opening mode, operating-system protections, and resulting permissions. Those safeguards are not established by the reviewed repository. ### Attack Path 1. The browser session authenticates to a web application. 2. The agent follows the documented ...[truncated 1300 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: profiles/domain-reddit.json:52
Finding: Reddit Profile Provides a Third-Party Account Creation and CAPTCHA Outsourcing Workflow
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: profiles/domain-google.json:69
Finding: Google Profile Instructs Residential-IP Signup Automation and CAPTCHA Delegation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (71)

Ssd 2

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This section explicitly frames real-browser fingerprinting and UI-only interaction as a way to avoid automation detection and get blocked less often. That guidance materially increases the skill's abuse potential for stealthy scraping, fraud, or unauthorized interaction against third-party sites by teaching operators how to blend in and evade anti-bot defenses.
Content: No source excerpt is available for this finding.

Ssd 2

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill repeatedly instructs the operator to add human-like pacing, jitter, mouse trajectories, and typo patterns so automation resembles a real user. These are classic anti-detection tradecraft features that make abusive automation more resilient and harder for defenders to distinguish from legitimate traffic.
Content: No source excerpt is available for this finding.

Ssd 2

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The CAPTCHA section advises building Google cookie history to alter challenge behavior, which is effectively guidance for influencing or weakening bot-detection outcomes. Even though it is framed as testing, it teaches a practical anti-detection method that can be repurposed for evasion on protected sites.
Content: No source excerpt is available for this finding.

Ssd 2

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Behavioral and domain-specific profiles for major platforms provide tailored interaction patterns, selectors, and sequence hints that lower the effort required to automate those sites covertly. In context, this goes beyond generic testing support and meaningfully enables stealthy scripted interaction against third-party services.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code injects a hardcoded secret into a live login form, which means the credential is embedded in source code and likely to leak through version control, logs, screenshots, or code reuse. In the context of a browser automation skill that performs real account login and 2FA, this is especially dangerous because compromise of the secret can enable unauthorized access to the target account.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The profile is labeled as a Reddit thread/comment browser, but it embeds a full account-creation workflow including CAPTCHA-solving delegation, IMAP mailbox access, and profile persistence. These capabilities materially expand the skill from passive browsing into account automation and anti-abuse evasion, which can enable unauthorized account creation, bulk account farming, and handling of sensitive mailbox credentials/data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The content explicitly instructs the agent to detect CAPTCHA challenges, capture screenshots, and send them to a provider for solving. CAPTCHA-solving delegation is an anti-abuse circumvention technique that facilitates automated account creation and access at scale despite platform defenses.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · profiles/parent-30-45.json (reported line 4)May include surrounding context.
json
{ "id": "parent-30-45", "label": "Parent 30-45", "emoji": "👨‍👩‍👧‍👦", "demographics": { "gender": "any", "age_range": [30, 45], "tier": "millennial-gen-x" }, "active_hours": { "description": "Fragmented — early morning, school hours, after kids bedtime", "peak": [6, 9, 13, 15, 21, 23], "off_peak_min": 5 }, "typing": { "description": "Interrupted typing — possible pauses for distractions, moderate speed", "wpm": { "min": 65, "max": 95 }, "profile": "careful", "think_prob": 0.018, "think_ms": [500, 2000], "backspace_freq": 0.035 }, "scroll": { "passes": 2, "descriptio

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · profiles/college-female-18-24.json (reported line 4)May include surrounding context.
json
{ "id": "urban-professional-male-25-34", "label": "Urban Professional Male 25-34", "emoji": "👨‍💼", "demographics": { "gender": "male", "age_range": [25, 34], "tier": "millennial" }, "active_hours": { "description": "Work hours + evening unwind", "peak": [8, 12, 14, 17, 22, 0], "off_peak_min": 6 }, "typing": { "description": "Business speed, direct, to the point", "wpm": { "min": 80, "max": 110 }, "profile": "natural", "think_prob": 0.01, "think_ms": [300, 1000], "backspace_freq": 0.03 }, "scroll": { "passes": 2, "description": "Purpose-driven, scans then acts", "speed_px_per_ms": { "min": 25, "max": 60 },

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · profiles/college-male-18-24.json (reported line 4)May include surrounding context.
json
{ "id": "urban-professional-male-25-34", "label": "Urban Professional Male 25-34", "emoji": "👨‍💼", "demographics": { "gender": "male", "age_range": [25, 34], "tier": "millennial" }, "active_hours": { "description": "Work hours + evening unwind", "peak": [8, 12, 14, 17, 22, 0], "off_peak_min": 6 }, "typing": { "description": "Business speed, direct, to the point", "wpm": { "min": 80, "max": 110 }, "profile": "natural", "think_prob": 0.01, "think_ms": [300, 1000], "backspace_freq": 0.03 }, "scroll": { "passes": 2, "description": "Purpose-driven, scans then acts", "speed_px_per_ms": { "min": 25, "max": 60 },

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · profiles/tech-worker-25-40.json (reported line 4)May include surrounding context.
json
{ "id": "urban-professional-male-25-34", "label": "Urban Professional Male 25-34", "emoji": "👨‍💼", "demographics": { "gender": "male", "age_range": [25, 34], "tier": "millennial" }, "active_hours": { "description": "Work hours + evening unwind", "peak": [8, 12, 14, 17, 22, 0], "off_peak_min": 6 }, "typing": { "description": "Business speed, direct, to the point", "wpm": { "min": 80, "max": 110 }, "profile": "natural", "think_prob": 0.01, "think_ms": [300, 1000], "backspace_freq": 0.03 }, "scroll": { "passes": 2, "description": "Purpose-driven, scans then acts", "speed_px_per_ms": { "min": 25, "max": 60 },

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · profiles/urban-professional-female-25-34.json (reported line 4)May include surrounding context.
json
{ "id": "urban-professional-male-25-34", "label": "Urban Professional Male 25-34", "emoji": "👨‍💼", "demographics": { "gender": "male", "age_range": [25, 34], "tier": "millennial" }, "active_hours": { "description": "Work hours + evening unwind", "peak": [8, 12, 14, 17, 22, 0], "off_peak_min": 6 }, "typing": { "description": "Business speed, direct, to the point", "wpm": { "min": 80, "max": 110 }, "profile": "natural", "think_prob": 0.01, "think_ms": [300, 1000], "backspace_freq": 0.03 }, "scroll": { "passes": 2, "description": "Purpose-driven, scans then acts", "speed_px_per_ms": { "min": 25, "max": 60 },

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · profiles/urban-professional-male-25-34.json (reported line 4)May include surrounding context.
json
{ "id": "urban-professional-male-25-34", "label": "Urban Professional Male 25-34", "emoji": "👨‍💼", "demographics": { "gender": "male", "age_range": [25, 34], "tier": "millennial" }, "active_hours": { "description": "Work hours + evening unwind", "peak": [8, 12, 14, 17, 22, 0], "off_peak_min": 6 }, "typing": { "description": "Business speed, direct, to the point", "wpm": { "min": 80, "max": 110 }, "profile": "natural", "think_prob": 0.01, "think_ms": [300, 1000], "backspace_freq": 0.03 }, "scroll": { "passes": 2, "description": "Purpose-driven, scans then acts", "speed_px_per_ms": { "min": 25, "max": 60 },

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · .cursor/plugin.json (reported line 10)May include surrounding context.
json
{ "name": "real-browser-qa-ceki", "description": "Rent real residential Chrome browsers for QA testing, security auditing, and vulnerability discovery", "url": "https://api.ceki.me/mcp/agent", "install": { "pip": "ceki-sdk", "npm": "@ceki/sdk",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · .cursor/plugin.json (reported line 25)May include surrounding context.
json
{ "name": "real-browser-qa-ceki", "description": "Rent real residential Chrome browsers for QA testing, security auditing, and vulnerability discovery", "url": "https://api.ceki.me/mcp/agent", "install": { "pip": "ceki-sdk", "npm": "@ceki/sdk",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · .mcp.json (reported line 4)May include surrounding context.
json
{ "name": "real-browser-qa-ceki", "description": "Rent real residential Chrome browsers for QA testing, security auditing, and vulnerability discovery", "url": "https://api.ceki.me/mcp/agent", "install": { "pip": "ceki-sdk", "npm": "@ceki/sdk",

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Lines L020-L035 state a critical rule of 'NO DIRECT API CALLS — UI ONLY' and describe direct HTTP requests as forbidden. However, later examples explicitly use curl to call https://api.ceki.me/... for auth introspection and rate-limit checks, which contradicts the stated rule as written rather than merely omitting an exception.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
| ❌ Wrong (detected, blocked) | ✅ Right (looks human) | |------------------------------|----------------------| | `curl -X POST https://api.site.com/...` | `ceki navigate` → `ceki type` → `ceki click` | | `fetch('/api/data', {headers: {...}})` inside CDP eval | `ceki scroll` → `ceki snapshot` → read the page | | GraphQL/API calls to internal endpoints | Fill the web form like a person would |

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The interaction pyramid in L044-L049 describes Runtime.evaluate as read-only and 'never for writing data.' Later sections L462-L470 and L482-L493 explicitly provide Runtime.evaluate examples that set textarea values and dispatch input/change events, directly contradicting the earlier guidance.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The 'NOT appropriate — ever' section forbids using the skill on sites you do not own and disallows account creation on services other than your own. Later, the domain-profile section provides scripting guidance, selectors, and interaction patterns for Twitter/X, LinkedIn, Reddit, YouTube, Amazon, Facebook, Instagram, and TikTok, which encourages use on third-party platforms and conflicts with the earlier intent restrictions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.
bash
curl -s -H "Authorization: Bearer $CEKI_API_KEY" \ https://api.ceki.me/api/auth/introspect | jq '.tokenable_id, .name'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 623)May include surrounding context.
bash
curl -s -H "Authorization: Bearer $CEKI_API_KEY" \ https://api.ceki.me/api/auth/introspect | jq '.tokenable_id, .name'

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The demographic-profile feature encourages age- and gender-based behavioral simulation without a clear necessity, consent model, or governance boundary. In a real-browser rental context, this can facilitate deceptive impersonation, profiling, or discriminatory targeting while making abusive automation harder to detect.
Content: No source excerpt is available for this finding.

Tainted flow: 'png' from os.environ.get (line 47, credential/environment) → pathlib.Path.write_bytes (file write)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · examples/python-quickstart.py (reported line 49)May include surrounding context.
python
png = await browser.screenshot(format="png") out = Path("/tmp/ceki_quickstart.png") out.write_bytes(png) print(f"Screenshot saved: {out}") snap = await browser.snapshot()

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest explicitly describes a mode where a remote host can observe rented browser sessions, but it does not present a clear privacy or data-exposure warning in the security-relevant metadata. Users may reasonably use the skill for QA or security testing and enter credentials, tokens, internal URLs, or sensitive app data without understanding that another opted-in host may be able to view session contents.
Content: No source excerpt is available for this finding.