ko-browser

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:55 AM UTC
• Version: 0.1.1

Overview

This browser automation skill is coherent, but it exposes saved credentials, browser sessions, raw debugging access, and unpinned installation paths without enough safety guidance.

Install only if you are comfortable giving the agent broad control over browser sessions. Avoid using it with high-value accounts unless you control where profiles, auth.json files, recordings, traces, and credentials are stored; pin and verify the upstream kbr version before installation; and require explicit approval before login, session export, cookie/storage access, CDP URL use, JavaScript evaluation, recording, uploads, downloads, or clipboard operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:9
• Finding: Unpinned Third-Party Executable Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:9-27` **Vulnerability Type**: Unpinned and mutable third-party executable dependency **Risk Level**: High ### Vulnerable Code ```bash The CLI uses Chrome/Chromium via CDP directly. Install via `go install github.com/libi/ko-browser/cmd/kbr@latest` or build from source. Run `kbr install` to verify Chrome is available, or `kbr install --with-deps` to auto-install it. ## Installation # Install kbr binary directly (no CGO, no external dependencies) go install github.com/libi/ko-browser/cmd/kbr@latest # Or build from source git clone https://github.com/libi/ko-browser.git cd ko-browser go build -o kbr ./cmd/kbr/ mv kbr /usr/local/bin/ # Verify browser dependency kbr install # Auto-install Chrome if missing kbr install --with-deps ``` ### Technical Analysis The Skill directs agents to install and execute software from a mutable upstream source. The `@latest` version selector does not identify a fixed, previously audited release. Similarly, cloning the repository without checking out a pinned commit builds whichever revision is on the upstream default branch at installation time. No checksum, source commit, cryptographic signature, or other integrity verification is specified. Consequently, the executable installed at runtime can differ from the implementation present when the Skill was reviewed. The `kbr install --with-deps` command can also initiate additional dependency installation through the unverified executable. This creates a supply-chain trust boundary in which compromise of the upstream repository, maintainer account, release process, module distribution path, or dependency chain could cause attacker-controlled code to run locally. ### Attack Path 1. An attacker compromises the upstream repository, maintainer credentials, release process, or another dependency involved in building the latest version. 2. The attacker publishes malicious code under the mutable version resolved by `@la ...[truncated 1191 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a specific, reviewed version: ```bash go install github.com/libi/ko-browser/cmd/kbr@vX.Y.Z ``` 2. For source builds, check out a full, reviewed commit hash before building: ```bash git clone https://github.com/libi/ko-browser.git cd ko-browser git checkout --detach <reviewed-full-commit-hash> ``` 3. Publish and verify SHA-256 checksums or cryptographic signatures for distributed binaries and source archives. 4. Record the expected version, commit hash, source digest, and verification procedure in the Skill. 5. Avoid moving an unverified executable into a system-wide executable directory. 6. Review the behavior of `kbr install --with-deps` and pin all packages or browser artifacts that it retrieves. 7. Perform installation in a sandbox or low-privilege environment and promote the binary only after integrity and security checks succeed. 8. Establish an update process requiring explicit review before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:115
• Finding: Authentication Secrets and Session State May Be Exposed in Plaintext<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:115-125` **Additional Occurrences**: `SKILL.md:296-300`, `SKILL.md:400-421` **Vulnerability Type**: Plaintext credential arguments and insecure authentication-state export guidance **Risk Level**: Medium ### Vulnerable Code ```bash # After logging in: kbr state export ./auth.json # In a future session: kbr state import ./auth.json kbr open https://app.example.com/dashboard ``` ```bash # Auth vault (credentials stored, login by name) kbr auth save mysite --url https://app.example.com/login --username user --password pass kbr auth login mysite ``` The same patterns are repeated later: ```bash kbr state export auth.json kbr state import auth.json kbr auth save mysite --url <url> --username <user> --password <pass> ``` ```bash # Save credentials once kbr auth save github --url https://github.com/login --username user --password pass # Login once and save state kbr state export auth.json ``` ### Technical Analysis The Skill demonstrates passing a password directly through the `--password` command-line argument. If a real password is substituted, it may be exposed through shell history, command logging, audit records, process inspection, terminal capture, or agent execution transcripts, depending on the operating environment. The Skill also exports cookies and localStorage into a predictable plaintext file named `auth.json`. Browser cookies and storage values can contain reusable session tokens, refresh tokens, anti-CSRF values, and other authentication material. The instructions do not require restrictive file permissions, encryption, secure deletion, repository exclusion, or storage outside the working directory. Although these commands are legitimate authentication features, the documented handling pattern creates avoidable opportunities for local credential disclosure and authenticated-session theft. ### Attack Path 1. A user or agent replaces the example password with a real credenti ...[truncated 1386 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not pass real passwords directly as command-line arguments. Prefer protected standard input, an interactive no-echo prompt, operating-system credential storage, or an approved secret manager. 2. Update the CLI and documentation to support password input through an environment-specific secret reference rather than the password value itself. 3. Warn users that environment variables may also be exposed through process environments or logs and should only be used when the execution environment protects them. 4. Store exported browser state in a dedicated private directory rather than the project root. 5. Create state files with owner-only permissions, such as mode `0600` on Unix-like systems. 6. Encrypt exported state at rest using a key stored separately from the state file. 7. Add authentication-state filenames and directories to `.gitignore` and other artifact-exclusion configurations. 8. Delete state files securely as soon as they are no longer needed. 9. Avoid displaying saved secrets through commands such as profile inspection unless sensitive fields are redacted. 10. Document session revocation procedures so users can invalidate exposed cookies, tokens, or stored credentials immediately. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The documentation normalizes credential persistence (`auth save`) and session/state export/import without prominent warnings that these artifacts may contain passwords, cookies, tokens, and authenticated browser state. In an agent setting, this can lead to accidental long-term storage, reuse, or exfiltration of sensitive authentication material.

Context Leakage

High

• Category: Data Exfiltration

Content

kbr --headed open https://example.com
kbr highlight 1                       # Highlight element
kbr inspect                           # Open Chrome DevTools
kbr record start                      # Record session
kbr profiler start                    # Start profiling
kbr profiler stop trace.json          # Stop and save
```

• Confidence: 85% confidence
• Finding: Session recording can capture page contents, typed inputs, tokens displayed in the UI, and other sensitive contextual data during authenticated browsing. In an agent workflow, recorded artifacts may later be stored, shared, or inspected outside the original security boundary, causing context leakage.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger text is very broad and includes generic phrases like opening websites, logging in, scraping, and automating browser actions. Overbroad triggers increase the chance the skill is invoked in situations where browser automation is unnecessary or risky, including sessions involving credentials, sensitive data, or untrusted pages.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install --cask google-chrome

# Linux (Debian/Ubuntu)
sudo apt-get install -y chromium-browser

# Linux (Alpine)
apk add chromium

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Exposing the raw CDP WebSocket URL gives downstream code a direct handle to the full browser debugging interface, which typically provides capabilities far beyond the documented CLI commands. An agent or chained tool with that endpoint could inspect network traffic, extract cookies/storage, execute arbitrary JS, manipulate pages, or attach other automation clients outside the skill's guardrails.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly exposes arbitrary JavaScript evaluation in the browser context via `kbr eval`. That goes beyond constrained browser automation primitives and can be abused to read page state, local/session storage, DOM content, or execute privileged automation logic that bypasses the intended element-based workflow, increasing risk when agents handle sensitive sites.

Static analysis

No suspicious patterns detected.