ClawHub
Back to skill

Security audit

Chrome DevTools MCP Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it asks users to run a mutable npm package with live browser access, which is high-impact enough to require careful review.

Install only if you are comfortable giving the tool access to a debuggable Chrome session and running the current npm-published version at use time. Prefer an isolated browser profile, avoid sensitive tabs, and pin or vet the `chrome-devtools-mcp` package before creating persistent UXC links.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:22
Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:22-33, 40-50; references/usage-patterns.md:3-11, 27-35, 109-113; scripts/validate.sh:44-54, 126-128
Vulnerability Type: Mutable, automatically executed third-party dependency
Risk Level: High

Vulnerable Code

From SKILL.md:22-33:

markdown
- Raw package form from official docs:
  - `npx chrome-devtools-mcp@latest`
- Reliable non-interactive form:
  - `npx -y chrome-devtools-mcp@latest`
- Default live-browser endpoint for this skill:
  - `npx -y chrome-devtools-mcp@latest --autoConnect --no-usage-statistics`
- Explicit browser-url endpoint:
  - `npx -y chrome-devtools-mcp@latest --browserUrl http://127.0.0.1:9222 --no-usage-statistics`
- Fallback isolated endpoint:
  - `npx -y chrome-devtools-mcp@latest --headless --isolated --no-usage-statistics`

From SKILL.md:40-50:

markdown
3. Use a fixed link command by default:
   - `command -v chrome-devtools-mcp-cli`
   - If missing, create it:
     - `uxc link chrome-devtools-mcp-cli "npx -y chrome-devtools-mcp@latest --autoConnect --no-usage-statistics"`
   - Optional explicit browser-url link:
     - `command -v chrome-devtools-mcp-port`
     - `uxc link chrome-devtools-mcp-port "npx -y chrome-devtools-mcp@latest --browserUrl http://127.0.0.1:9222 --no-usage-statistics"`
   - Optional isolated fallback link:
     - `command -v chrome-devtools-mcp-isolated`
     - `uxc link chrome-devtools-mcp-isolated "npx -y chrome-devtools-mcp@latest --headless --isolated --no-usage-statistics"`

From references/usage-patterns.md:3-11:

markdown
This skill defaults to a live-browser stdio endpoint:
`npx -y chrome-devtools-mcp@latest --autoConnect --no-usage-statistics`

This skill defaults to the fixed link command `chrome-devtools-mcp-cli`.
Create it when missing:

```bash
command -v chrome-devtools-mcp-cli
uxc link chrome-devtools-mcp-cli "npx -y chrome-devtools-mcp@latest --autoConnect --no-usage-statistics"
text

The validation scr
...[truncated 3487 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace every chrome-devtools-mcp@latest reference with an exact, reviewed version, for example:

    bash
    npx --yes --package chrome-devtools-mcp@X.Y.Z chrome-devtools-mcp --autoConnect --no-usage-statistics

    The actual version must be selected after review rather than copied from this placeholder.

  2. Record and verify dependency integrity using a committed lockfile, npm integrity metadata, a trusted internal registry, or an equivalent immutable artifact mechanism.

  3. Update the UXC links to reference the same exact audited version. Do not retain @latest in reusable command definitions.

  4. Modify scripts/validate.sh so that it rejects @latest and verifies the approved exact version instead of requiring a mutable dependency selector.

  5. Establish a controlled upgrade process:

    • Review upstream release notes and source changes.
    • Verify publisher and package provenance.
    • Run security and behavioral tests in isolation.
    • Update the approved version and integrity metadata only after review.

  6. Prefer installing the reviewed dependency in a controlled environment before execution. Where operationally feasible, avoid automatic installation acceptance and require explicit approval for dependency changes.

  7. Run the MCP process with least privilege and isolate it from unrelated credentials and files. Use the isolated browser mode unless access to a live authenticated browser is specifically required.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (18)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description presents live-browser autoConnect as the default but does not clearly warn that the tool can inspect active logged-in tabs, DOM contents, console messages, and network activity from the local Chrome session. This missing disclosure materially increases the chance that a user grants broad access to sensitive browsing context without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The prerequisites mention first-time package fetch and remote browser attachment, but omit a direct safety warning that these actions may cause network activity and enable inspection of local browser data. In this context, the omission is significant because the skill is specifically designed to access debugging interfaces tied to potentially authenticated browsing sessions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The skill invokes an MCP server via npx using the moving 'latest' tag rather than a fixed version, which allows future upstream package changes or a supply-chain compromise to alter what code is executed. Because this skill is designed to launch the package locally and connect it to browser automation capabilities, an unexpected package update could immediately gain access to sensitive browsing context and local environment behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

Using 'npx -y chrome-devtools-mcp@latest' performs non-interactive execution of whatever code is currently published under that package tag, removing an opportunity for user review at install time. In a security-sensitive skill that controls DevTools access, this increases supply-chain risk and can expose browser data or enable arbitrary local actions through a compromised dependency.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The default endpoint uses 'npx -y ...@latest --autoConnect', combining unpinned package execution with automatic attachment to a live local browser. This is dangerous because a malicious or altered upstream release could immediately inspect or manipulate active browser sessions, including logged-in tabs, console output, and network traffic.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The explicit browserUrl endpoint still relies on 'npx -y ...@latest', so the code being executed is not stable or reviewed at the time the skill is used. Since it connects directly to a remote-debugging endpoint, a compromised package could harvest page content, cookies-in-context behavior, requests, and other sensitive browser state.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Although isolated mode is safer than attaching to a live browser, invoking an unpinned package from '@latest' still creates a supply-chain execution risk on the local machine. A malicious update could abuse the local execution context even if it is not connected to an existing user browser session.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The probe command executes the same unpinned MCP package during validation, so even a 'help' style check still runs unreviewed code fetched at runtime. Because the skill normalizes this as part of setup, users may execute potentially compromised code before understanding the trust boundary.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The link creation command permanently registers a launcher that resolves to 'npx -y ...@latest', causing future invocations to continue pulling or trusting a moving target. This extends the supply-chain risk beyond one-time execution and makes subsequent browser-access operations dependent on whatever upstream code is current at run time.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

This optional browser-url link also registers a persistent command around an unpinned latest-tag package while targeting a remote-debugging endpoint. That combination can expose highly sensitive browser state if the package changes maliciously or unexpectedly upstream.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill invokes npx -y chrome-devtools-mcp@latest, which fetches and executes the newest package version at runtime without pinning or integrity control. In a security-sensitive tool that can inspect and interact with a live browser, a compromised upstream release or dependency could immediately gain broad visibility into browser content, session data, and page interactions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This usage pattern again instructs users to execute npx -y chrome-devtools-mcp@latest, causing unreviewed code to be downloaded and run on demand. Because the skill is specifically designed to attach to a debuggable Chrome instance, any malicious update could abuse browser debugging capabilities to inspect pages, cookies, storage, and user activity.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The isolated fallback mode still uses npx -y ... @latest, so it retains the same supply-chain execution risk even if it is not attaching to an existing browser session. Although isolated mode may reduce access to a live user session, arbitrary code execution from an unpinned package remains dangerous on the local machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The examples encourage listing network requests and console messages from a live browser session without warning that these outputs can contain sensitive data such as tokens, internal URLs, personal information, or debugging secrets. In the context of a DevTools-attached live browser, omission of a privacy warning makes accidental disclosure more likely, especially when users inspect real sessions rather than test pages.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The documented fallback equivalence explicitly normalizes direct execution of uxc "npx -y chrome-devtools-mcp@latest ...", reinforcing a pattern of executing mutable remote code. Since this form may be used when link setup is unavailable, it increases the chance that users run the risky command directly without any local review or safeguards.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.