ClawHub
Back to skill

Security audit

Chrome DevTools MCP (Standard)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Chrome browser-automation helper, but it asks users to run mutable third-party MCP packages with broad browser control and limited safety scoping.

Install only if you are comfortable giving an agent strong local Chrome control. Prefer pinning exact package versions, using a dedicated browser profile without sensitive sessions, avoiding `@latest` MCP startup, and reviewing any `sudo`, npm, npx, or plugin commands before running them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:42
Finding

Unpinned Third-Party Package Installation and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-89; additional occurrences at lines 195 and 211
Vulnerability Type: Supply-chain risk caused by unpinned dependencies
Risk Level: Medium

Vulnerable Code

bash
npm i -g chrome-devtools-mcp
bash
npx -y chrome-devtools-mcp@latest
json
{
  "mcpServers": {
    "chrome-devtools": {
      "command": "npx",
      "args": ["-y", "chrome-devtools-mcp@latest", "--no-usage-statistics"]
    }
  }
}
json
{
  "mcpServers": {
    "chrome-devtools": {
      "command": "npx",
      "args": ["-y", "chrome-devtools-mcp@latest", "--slim", "--headless", "--no-usage-statistics"]
    }
  }
}
bash
/plugin marketplace add ChromeDevTools/chrome-devtools-mcp
/plugin install chrome-devtools-mcp
yaml
mcp:
  servers:
    chrome-devtools:
      command: npx
      args: ["-y", "chrome-devtools-mcp@latest", "--no-usage-statistics"]

Additional unpinned executions include:

bash
npx @puppeteer/browsers install chrome@stable
npx -y chrome-devtools-mcp@latest --headless

Technical Analysis

The documented installation and configuration procedures execute third-party packages without pinning them to reviewed, immutable versions. The global npm installation implicitly resolves the current registry version, while several configurations explicitly request @latest. The plugin installation and @puppeteer/browsers command are similarly not tied to a reviewed version.

The npx -y option automatically accepts installation without an interactive confirmation step. Consequently, the code executed on a future invocation may differ from the code that existed when this skill was audited. Package lifecycle scripts may also execute during installation.

This creates a supply-chain trust boundary in which compromise of the package, npm account, registry resolution, plugin marke ...[truncated 1791 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest, @stable, and implicit latest-version resolution with exact, reviewed versions, for example:

    bash
    npx --yes chrome-devtools-mcp@<reviewed-exact-version> --no-usage-statistics

  2. Pin transitive dependencies with a committed lockfile where installation occurs through a managed project rather than ad hoc global execution.

  3. Verify downloaded packages using registry integrity metadata, checksums, signatures, or provenance attestations. Store expected verification data in a reviewed configuration.

  4. Avoid global package installation. Install dependencies in an isolated project or controlled container using an unprivileged account.

  5. Avoid automatic mutable dependency installation during MCP startup. Preinstall and review a fixed artifact, then configure the MCP server to invoke that local artifact.

  6. Configure an approved registry or internal artifact mirror and enforce package allowlists.

  7. Disable or strictly control npm lifecycle scripts where compatible with the package.

  8. Pin plugin marketplace sources and plugin versions to reviewed revisions or immutable release artifacts.

  9. Run the MCP server and Chrome in a sandbox with a dedicated browser profile, minimal filesystem access, restricted environment variables, and no unnecessary credentials.

  10. Establish a controlled update process in which new versions are reviewed, scanned, tested, and explicitly approved before changing the pin.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
### Prerequisites
- **Node.js** v20.19+ (check: `node --version`)
- **Google Chrome** stable (check: `which google-chrome` or `which chromium-browser`)
  - On Ubuntu/Debian: `wget -q https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb && sudo apt install -y ./google-chrome-stable_current_amd64.deb`
  - On macOS: Install from google.com/chrome or `brew install --cask google-chrome`
  - On ARM64 Linux: Use `chromium-browser` or Chrome for Testing

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description emphasizes broad browser control but does not clearly warn that the skill can interact with authenticated sessions, inspect network traffic, execute page-context JavaScript, and affect local browsing state. In an agent environment, lack of explicit safety boundaries increases the chance of misuse against sensitive sites or accidental privacy-impacting actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The keywords include generic triggers like "use browser" and "use chrome-devtools-mcp" without any constraints on context. In a manifest-style section, these broad phrases can match many ordinary requests involving browsing or web access, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
### Prerequisites
- **Node.js** v20.19+ (check: `node --version`)
- **Google Chrome** stable (check: `which google-chrome` or `which chromium-browser`)
  - On Ubuntu/Debian: `wget -q https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb && sudo apt install -y ./google-chrome-stable_current_amd64.deb`
  - On macOS: Install from google.com/chrome or `brew install --cask google-chrome`
  - On ARM64 Linux: Use `chromium-browser` or Chrome for Testing

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The OpenClaw config invokes npx with chrome-devtools-mcp@latest, causing execution of whatever package version is current at runtime. In an agent skill context, this creates a real supply-chain exposure because future upstream compromise or malicious typosquatting/substitution could lead to arbitrary code execution on the host.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

bash
# Ubuntu/Debian amd64:
wget -q https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
sudo apt install -y ./google-chrome-stable_current_amd64.deb

# Or use Chrome for Testing:
npx @puppeteer/browsers install chrome@stable

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The troubleshooting advice again recommends npx -y chrome-devtools-mcp@latest --headless, which executes the newest published package at runtime. In a browser-automation skill with local host access, an upstream compromise could translate into arbitrary local code execution and broad browser-driven actions.

Content

No source excerpt is available for this finding.