Security audit

ko-browser

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is coherent, but it exposes saved credentials, browser sessions, raw debugging access, and unpinned installation paths without enough safety guidance.

Install only if you are comfortable giving the agent broad control over browser sessions. Avoid using it with high-value accounts unless you control where profiles, auth.json files, recordings, traces, and credentials are stored; pin and verify the upstream kbr version before installation; and require explicit approval before login, session export, cookie/storage access, CDP URL use, JavaScript evaluation, recording, uploads, downloads, or clipboard operations.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:9
Finding: Unpinned Third-Party Executable Installation
Content: View full analysis
Remediation: View remediation
``` 3. Publish and verify SHA-256 checksums or cryptographic signatures for distributed binaries and source archives. 4. Record the expected version, commit hash, source digest, and verification procedure in the Skill. 5. Avoid moving an unverified executable into a system-wide executable directory. 6. Review the behavior of `kbr install --with-deps` and pin all packages or browser artifacts that it retrieves. 7. Perform installation in a sandbox or low-privilege environment and promote the binary only after integrity and security checks succeed. 8. Establish an update process requiring explicit review before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:115
Finding: Authentication Secrets and Session State May Be Exposed in Plaintext
Content: View full analysis
--username --password ``` ```bash # Save credentials once kbr auth save github --url https://github.com/login --username user --password pass # Login once and save state kbr state export auth.json ``` ### Technical Analysis The Skill demonstrates passing a password directly through the `--password` command-line argument. If a real password is substituted, it may be exposed through shell history, command logging, audit records, process inspection, terminal capture, or agent execution transcripts, depending on the operating environment. The Skill also exports cookies and localStorage into a predictable plaintext file named `auth.json`. Browser cookies and storage values can contain reusable session tokens, refresh tokens, anti-CSRF values, and other authentication material. The instructions do not require restrictive file permissions, encryption, secure deletion, repository exclusion, or storage outside the working directory. Although these commands are legitimate authentication features, the documented handling pattern creates avoidable opportunities for local credential disclosure and authenticated-session theft. ### Attack Path 1. A user or agent replaces the example password with a real credenti ...[truncated 1386 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation normalizes credential persistence (auth save) and session/state export/import without prominent warnings that these artifacts may contain passwords, cookies, tokens, and authenticated browser state. In an agent setting, this can lead to accidental long-term storage, reuse, or exfiltration of sensitive authentication material.
Content: No source excerpt is available for this finding.

Context Leakage

High

Category: Data Exfiltration
Confidence: 85% confidence
Finding: Session recording can capture page contents, typed inputs, tokens displayed in the UI, and other sensitive contextual data during authenticated browsing. In an agent workflow, recorded artifacts may later be stored, shared, or inspected outside the original security boundary, causing context leakage.
Content: Scanner excerpt · SKILL.md (reported line 480)May include surrounding context.
kbr --headed open https://example.com kbr highlight 1 # Highlight element kbr inspect # Open Chrome DevTools kbr record start # Record session kbr profiler start # Start profiling kbr profiler stop trace.json # Stop and save

text

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger text is very broad and includes generic phrases like opening websites, logging in, scraping, and automating browser actions. Overbroad triggers increase the chance the skill is invoked in situations where browser automation is unnecessary or risky, including sessions involving credentials, sensitive data, or untrusted pages.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
brew install --cask google-chrome # Linux (Debian/Ubuntu) sudo apt-get install -y chromium-browser # Linux (Alpine) apk add chromium

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Exposing the raw CDP WebSocket URL gives downstream code a direct handle to the full browser debugging interface, which typically provides capabilities far beyond the documented CLI commands. An agent or chained tool with that endpoint could inspect network traffic, extract cookies/storage, execute arbitrary JS, manipulate pages, or attach other automation clients outside the skill's guardrails.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly exposes arbitrary JavaScript evaluation in the browser context via kbr eval. That goes beyond constrained browser automation primitives and can be abused to read page state, local/session storage, DOM content, or execute privileged automation logic that bypasses the intended element-based workflow, increasing risk when agents handle sensitive sites.
Content: No source excerpt is available for this finding.