Security audit

Phone Chrome CDP

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed browser-control helper, but it gives access to sensitive browser sessions and suggests LAN exposure without enough safeguards.

Install only if you understand CDP can inspect and change an authenticated browser session. Keep port 9222 local, avoid LAN exposure, use an isolated test profile where possible, and require explicit approval before reading cookies, modifying cookies, running page scripts, submitting forms, or taking screenshots.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill explicitly documents extraction of all browser cookies, including httpOnly cookies, via CDP. That enables session-token theft and account hijacking, and it exceeds ordinary page automation because httpOnly cookies are intentionally protected from page JavaScript. In the context of remote browser control on a real phone, this materially increases the sensitivity of the capability.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documentation advises exposing the local CDP endpoint to the LAN, turning a localhost-only debugging interface into a remotely reachable control plane. CDP grants powerful browser access including navigation, script execution, DOM reads, and cookie access, so LAN exposure can enable unauthorized remote control and data theft if the forwarded port is reachable by other hosts.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill bundles sensitive capabilities—cookie extraction, JavaScript injection, screenshots, and remote exposure—without any safety notice, consent boundaries, or handling guidance. Even if some features are legitimate for debugging, omitting warnings and guardrails makes misuse easier and increases the chance of privacy harm, credential leakage, or unsafe deployment.

Static analysis

No suspicious patterns detected.