Browser Fingerprint Audit

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed browser-fingerprint auditing helper; its main risk is that it runs a third-party npm CLI and may send fingerprint/network details to the service unless offline mode is used.

Install this if you are comfortable running the `liarjs` npm CLI for browser fingerprint testing. Use `--offline` when you do not want the browser to contact `liarjs.dev`, avoid CDP attachment unless you intentionally want the tool to interact with an existing browser session, and consider pinning or preinstalling a reviewed CLI version in sensitive environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Execution of a Mutable Third-Party npm Package Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-23; additional invocation at line 83
Vulnerability Type: Unsafe third-party dependency retrieval and execution
Risk Level: Medium

Vulnerable Code

bash

npx liarjs@0.3                    # launch a throwaway Chrome and scan it
npx liarjs@0.3 --all              # also list the checks that passed
npx liarjs@0.3 --offline          # JS-layer checks only, no outbound request
npx liarjs@0.3 --json scan.json   # save the full result for later comparison

The same package is also invoked when attaching to an existing browser:

bash

npx liarjs@0.3 --cdp http://127.0.0.1:9222

Technical Analysis

The Skill instructs the Agent to execute liarjs directly through npx. If the package is unavailable locally, npx can retrieve it from the configured npm registry and immediately execute its code. The version range 0.3 is not an immutable artifact reference and is not accompanied by a lockfile, package integrity hash, vendored source, or other verification mechanism within this project.

Consequently, the effective executable code is outside the audited project and may change independently after the Skill has been reviewed. A compromised publisher account, npm registry, package release, or dependency graph could cause attacker-controlled lifecycle scripts or CLI code to execute with the permissions of the Agent process.

The documented --offline option only describes the network behavior of the fingerprint scan. It does not establish the authenticity of the npm package or prevent npx from retrieving and executing package code.

No evidence in the reviewed project establishes that the current liarjs package is malicious. The finding concerns the unsafe, mutable supply-chain execution mechanism.

Attack Path

1. An attacker compromises the npm package, its publisher account, the configured registry, or a transitive dependency a ...[truncated 1309 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable 0.3 version selector with an exact, reviewed package version.
2. Install the dependency through a committed lockfile that records resolved versions and integrity metadata rather than downloading it ad hoc during Skill execution.
3. Verify package integrity and provenance against an approved artifact or trusted registry before execution.
4. Where practical, vendor the reviewed implementation or distribute a cryptographically verified release artifact so the executed code matches the audited code.
5. Disable npm lifecycle scripts where compatible, and review both direct and transitive dependencies before approval.
6. Run the CLI in an isolated, non-root environment with minimal filesystem and network access.
7. Preserve the existing requirement for explicit user approval before CDP attachment, and restrict the endpoint to the intended local browser.
8. Treat --offline only as an application-level network control; do not present it as a dependency-installation or supply-chain security control.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.