Google WebMCP

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent Google Search and Gemini bridge, but users should treat it as an authenticated Google integration and keep the profile isolated.

Install this only if you are comfortable letting an agent use a dedicated authenticated Google profile for Search and Gemini. Keep that profile separate from personal browsing, avoid secrets or regulated data in prompts/searches, and prefer a pinned or lockfile-managed Playwright install instead of resolving the latest package through npx.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Playwright Package Retrieval and Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- On a fresh machine, or under an isolated `HOME`, install Playwright browsers first with `npx playwright install`.

Technical Analysis

The documented command invokes playwright through npx without specifying a package version, lockfile, or integrity constraint. If Playwright is not already installed locally, npx can obtain the package from the configured npm registry and execute its CLI code. The effective code therefore depends on mutable registry state and local npm configuration rather than a reviewed, reproducible dependency set.

Exploitation requires the resolved package or dependency chain to be compromised, the configured registry to be malicious, or package resolution to otherwise return an unsafe release. This is a supply-chain weakness rather than evidence that the current Playwright package is malicious.

Attack Path

1. A user follows the prerequisite in SKILL.md on a system where Playwright is not installed locally.
2. npx resolves the unpinned playwright package using the user's npm configuration and registry.
3. An attacker-controlled registry, compromised package release, or compromised transitive dependency supplies malicious code.
4. npx downloads and executes the resolved package with the privileges of the invoking user.
5. The malicious code can access resources available to that user while presenting itself as the expected browser installation process.

Impact Assessment

Successful exploitation provides code execution with the privileges of the user running the command. The potential scope includes reading or modifying user-accessible files, accessing environment variables and npm configuration, making network requests, altering development artifacts, and compromising browser-related ...[truncated 266 chars]

Remediation

View remediation

Remediation Suggestions

1. Add Playwright as an explicitly version-pinned project dependency and commit the package-manager lockfile.
2. Install dependencies with a deterministic command such as npm ci, then run the reviewed local binary:

   bash

   npm ci
   npx --no-install playwright install
   

3. If direct invocation is unavoidable, specify an exact reviewed version rather than allowing latest-version resolution:

   bash

   npx --yes playwright@<reviewed-exact-version> install
   

4. Use a trusted npm registry and enforce lockfile integrity checks in CI.
5. Review dependency updates before changing the pinned version, and consider running browser installation in a restricted environment with minimal filesystem access and no unnecessary credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description says the skill operationally integrates with Google Search, Gemini, and a UXC/browser profile for user-facing tasks. However, the supplied code chunk only validates local files using ripgrep and shell checks. Its primary purpose is CI/style/package validation, not external service access or authenticated browser interaction. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly uses an authenticated Google/Gemini browser profile, but the description does not clearly warn users that prompts, searches, downloads, and account-context data may be transmitted to Google services. This can cause unintentional disclosure of sensitive data because users may invoke the skill without understanding that it operates under a signed-in profile and external service boundary.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill instructs users to run npx playwright install without pinning a specific Playwright version. This introduces supply-chain and reproducibility risk because the resolved package version can change over time, potentially pulling in a compromised or incompatible release during setup.

Content

No source excerpt is available for this finding.