Browser Agent - Chrome CDP 自动化

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:18 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is coherent, but it asks users to expose high-impact browser control over authenticated sessions with weak scoping and safety guidance.

Install only if you understand that this can control a real browser as you, including logged-in accounts. Use a dedicated automation Chrome profile with no personal sessions, avoid `--remote-allow-origins=*`, keep CDP bound to localhost, close the browser when done, and require explicit review before posting, deleting, typing credentials, running JavaScript, or capturing screenshots on sensitive pages.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:34
• Finding: Wildcard CDP WebSocket Origin Allowlist Exposes Authenticated Browser Sessions## Vulnerability Details **File Location**: `SKILL.md:34-43` **Additional Location**: `测试报告.md:163-183` **Vulnerability Type**: Unsafe Chrome DevTools Protocol configuration **Risk Level**: High ### Vulnerable Code ```bash chrome.exe --remote-debugging-port=9222 --remote-allow-origins=* --user-data-dir="C:\chrome-profile" ``` ```bash /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome \ --remote-debugging-port=9222 --remote-allow-origins=* \ --user-data-dir="/tmp/chrome-profile" ``` ### Technical Analysis The documented `--remote-allow-origins=*` option instructs Chrome to accept CDP WebSocket connections from every origin. This disables an origin-based security control that would otherwise reject unauthorized WebSocket clients. CDP provides extensive control over the attached browser, including: - Executing arbitrary JavaScript in pages through `Runtime.evaluate` - Reading page content and DOM state - Navigating tabs and submitting forms - Simulating mouse and keyboard input - Capturing screenshots - Performing actions through existing authenticated sessions The Skill explicitly promotes reuse of logged-in browser profiles, cookies, login state, and background permissions. Consequently, weakening CDP origin validation can expose substantially more than an isolated automation tab. A wildcard origin is not required for the declared browser-automation functionality. The specific trusted automation origin can be allowlisted instead. The test report confirms that Chrome originally returned HTTP 403 because of its origin protection and that the wildcard option was presented as the workaround. ### Attack Path 1. A user follows the Skill documentation and starts Chrome with remote debugging and `--remote-allow-origins=*`. 2. The browser uses a persistent profile containing authenticated website sessions. 3. The user opens attacker-controlled content, or an untrusted local client gains ...[truncated 1435 chars]
• Remediation: ## Remediation Suggestions 1. Replace the wildcard with the exact trusted automation origin: ```bash --remote-allow-origins=http://127.0.0.1:18800 ``` The permitted origin must match the actual trusted client configuration. 2. Ensure the debugging service listens only on loopback: ```bash --remote-debugging-address=127.0.0.1 ``` 3. Use a dedicated automation profile that does not contain personal browsing sessions or unrelated authenticated accounts. 4. Do not load untrusted websites while the debugging interface is active. 5. Shut down the debugging browser immediately after the automation task completes. 6. Update `SKILL.md` and `测试报告.md` to remove the wildcard recommendation and explain the risks of exposing an authenticated profile through CDP. 7. Prefer the OpenClaw browser integration when it provides authenticated and origin-restricted CDP access without disabling Chrome's protection globally.

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:4
• Finding: Unpinned Python Dependencies Permit Unreviewed Future Releases## Vulnerability Details **File Location**: `scripts/requirements.txt:4-7` **Additional Location**: `package.json:28-29` **Vulnerability Type**: Non-reproducible and insufficiently constrained dependencies **Risk Level**: Medium ### Vulnerable Code ```text websocket-client>=1.6.0 requests>=2.31.0 ``` The documented installation command is: ```bash pip install -r requirements.txt ``` ### Technical Analysis Both dependencies use open-ended lower-bound constraints. Any later package release satisfying the minimum version can therefore be selected during installation. The project does not provide: - Exact reviewed versions - A dependency lock file - Package hashes - An upper compatibility bound - An isolated-environment requirement This makes installation non-reproducible and expands the supply-chain trust boundary to include all future releases of both packages and their transitive dependencies. The package names and configured package source are not suspicious, and the reviewed project does not contain evidence that either dependency is currently malicious. The risk arises from accepting future or compromised releases without integrity verification. ### Attack Path 1. An upstream dependency, transitive dependency, or package-publishing account is compromised. 2. An attacker publishes a malicious version that satisfies the applicable `>=` constraint. 3. A user runs the documented `pip install -r requirements.txt` command. 4. The package resolver selects the malicious or otherwise unreviewed release. 5. Installation-time package behavior or subsequently imported code executes with the privileges of the user running the Skill. 6. The compromised dependency can access files, network resources, environment data, and browser automation capabilities available to that process. This path depends on an upstream supply-chain compromise or malicious future release; no such compromise was identified in ...[truncated 640 chars]
• Remediation: ## Remediation Suggestions 1. Pin dependencies to reviewed exact versions: ```text websocket-client==1.9.0 requests==2.32.5 ``` 2. Generate and maintain a lock file that includes transitive dependencies. 3. Record cryptographic hashes and install with hash enforcement: ```bash pip install --require-hashes -r requirements.txt ``` 4. Require installation inside a dedicated virtual environment rather than a global or privileged Python environment. 5. Perform dependency updates through a reviewed process that includes vulnerability scanning, changelog review, and automated tests. 6. Avoid running `pip install` as an administrator or root user. 7. Keep dependency declarations in `package.json` consistent with the authoritative Python lock or requirements file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly promotes social-media automation actions such as bulk posting/deleting tweets and automated likes/retweets without any warning about account-safety, platform-policy, consent, or abuse risks. In the context of a browser-control skill that can act on authenticated sessions, this lowers user caution and can enable unauthorized or policy-violating actions against third-party accounts or content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The custom-script example includes automated entry of login credentials, including a hardcoded password, with no warning about secret handling or authenticated-session risks. In a browser automation skill, this is dangerous because users may imitate the pattern, store real credentials in scripts, or expose secrets through logs, screenshots, repositories, or shared profiles.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly promotes reusing logged-in browser sessions via CDP and preserved cookies/login state, but does not present a prominent warning that this grants the agent access to sensitive authenticated state. In practice, this can let automation read private data, act as the user across sites, and exfiltrate session-derived information if misused or prompted unsafely.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill advertises actions such as bulk deleting or publishing Twitter/social-media content without a strong warning that the automation can perform irreversible account actions on the user's behalf. Because the skill integrates direct browser control with persistent sessions, prompt mistakes or abuse could cause unauthorized posts, deletions, or cross-platform account changes at scale.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This markdown file contains user-facing instructional content exclusively in Chinese, including the title, section headings, and inline explanations. Under the policy rules, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module docstring explicitly advertises bypassing browser security warning dialogs via raw CDP control. Even though this is documentation rather than code, it signals an intended security-evasion use case and increases the likelihood that the tool will be used to suppress protections around unsafe browsing, certificate errors, or other warning interstitials.

Dynamic Request Target

Medium

• Category: Server-Side Request Forgery

Content

def get_debugger_url(self) -> str:
        """获取 WebSocket 调试器 URL"""
        try:
            resp = requests.get(f"http://{self.host}:{self.port}/json/version", timeout=5)
            data = resp.json()
            return data.get("webSocketDebuggerUrl", "")
        except Exception as e:

• Confidence: 60% confidence
• Finding: Request target host is built from a dynamic or untrusted value. If the host is attacker-influenced, this enables SSRF to arbitrary internal or metadata endpoints.

Dynamic Request Target

Medium

• Category: Server-Side Request Forgery

Content

def get_debugger_url(self) -> str:
        """获取 WebSocket 调试器 URL"""
        try:
            resp = requests.get(f"http://{self.host}:{self.port}/json/version", timeout=5)
            data = resp.json()
            return data.get("webSocketDebuggerUrl", "")
        except Exception as e:

• Confidence: 60% confidence
• Finding: Request target host is built from a dynamic or untrusted value. If the host is attacker-influenced, this enables SSRF to arbitrary internal or metadata endpoints.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The evaluate method exposes arbitrary JavaScript execution in whatever page context the agent connects to. This allows manipulation of authenticated sessions, DOM scraping, token extraction, CSRF-like action triggering, and execution of untrusted operator-supplied code against live browser state.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Arbitrary JavaScript execution is exposed without any confirmation, policy checks, or contextual safety controls. In this tool's context, that makes dangerous browser-side actions easy to trigger silently against active tabs and authenticated sessions.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This code contains natural-language docstrings, comments, log messages, and example usage text exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document explicitly promotes connecting an agent to a real Chrome session that reuses login state, cookies, and existing browser permissions, but it does not warn that automation will act as the user on authenticated accounts. In this skill context, that omission is dangerous because the surrounding content encourages remote debugging and direct browser control, which can lead to data access, account changes, or destructive actions on live services.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The usage examples show navigation and click operations against a live browser without stating that these commands may execute on real logged-in sessions and cause irreversible account or data changes. Because this skill is specifically for browser automation via CDP/OpenClaw, examples are likely to be copied directly, increasing the risk of unintended actions on production accounts.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The report normalizes browser screenshot capture and local disk storage without any warning about sensitive data exposure. In a browser-automation skill, screenshots can contain authenticated sessions, personal data, tokens, or internal pages, and saving them to predictable local paths increases the risk of unintended retention or disclosure.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The report presents JavaScript evaluation in the browser as a normal capability without warning that page-context code will execute inside the active browsing session. In this skill context, that can interact with authenticated pages, read DOM-visible data, trigger state-changing actions, or execute untrusted snippets if copied into workflows without safeguards.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The README content is entirely in Chinese and does not indicate that other languages are supported or that the locale restriction is intentional for a region-specific tool. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy issue.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The package manifest uses Chinese-only natural-language description and command titles, which indicates a fixed locale presentation without any visible opt-in or alternative language support. Under the policy rule, forcing a specific language without user choice is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: All user-facing natural-language descriptions and usage instructions in the file are presented only in Chinese, with no indication that users may choose another language. This is a natural-language policy concern because it imposes a locale/language assumption without opt-in or documented justification.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The code writes screenshot data directly to a local path with open(..., "wb") but provides no confirmation prompt or inline warning about creating or overwriting files. Although the CLI later prints after saving, there is no advance disclosure at the point of the safety-relevant file write.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The file’s human-readable comments are written only in Chinese, which can indicate a language-specific constraint without any documented user choice or opt-in. Under the policy rule for natural-language violations, forcing a specific language is reportable unless the locale constraint is explicitly documented and justified.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Browser Agent 技能依赖

# WebSocket 客户端
websocket-client>=1.6.0

# HTTP 请求
requests>=2.31.0

• Confidence: 90% confidence
• Finding: Using an unpinned dependency range for websocket-client allows different versions to be installed over time, which can introduce vulnerable or incompatible releases into the environment without review. This weakens supply-chain integrity and reduces build reproducibility.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

websocket-client>=1.6.0

# HTTP 请求
requests>=2.31.0

# 可选：异步支持
# websockets>=12.0

• Confidence: 96% confidence
• Finding: Using requests>=2.31.0 without an exact pin permits installation of later versions that may have unresolved vulnerabilities or behavioral changes. Because requests is a widely used network library, version drift can expose the skill to known or future supply-chain and runtime security issues.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: The manifest references requests without pinning to a verifiable safe release, while the package has multiple known advisories across versions. Because the installed version is not fixed, it is impossible to determine from this file whether deployments will avoid affected releases, creating avoidable exposure in a network-facing dependency.

Intent-Code Divergence

Low

• Confidence: 91% confidence
• Finding: At L104 the documented invocation specifies `type="png"`, which implies a PNG screenshot should be created. However, the result at L109 shows the saved file path ending in `.jpg`, directly contradicting the documented behavior rather than merely omitting detail.

Static analysis

No suspicious patterns detected.