Security audit

Ask Gemini/ChatGPT

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-built for chatbot browser automation, but it gives broad control over a persistent logged-in Chrome profile through a local debugging port.

Install only if you are comfortable with a dedicated Chrome profile staying logged in to Google/OpenAI services and being controlled through a local CDP port. Avoid sending secrets or private data, prefer a dedicated account/profile, close Chrome when finished, and delete the profile if you no longer want stored sessions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes shell scripts and browser-driven network interactions, but does not declare permissions or clearly scope those capabilities. This reduces transparency and consent, making it easier for an agent or reviewer to underestimate that the skill can launch Chrome, reuse authenticated sessions, and transmit user data to external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description understates important behaviors: the skill reuses a local Chrome profile via CDP, relies on persisted logins, and may return citations/links in addition to chatbot text. This mismatch is dangerous because users and orchestrators may authorize a simple chat relay while the skill actually gains access to an authenticated browser context and third-party accounts.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill omits a warning that user prompts are sent to external chatbot providers and may be submitted through an already logged-in browser session. That creates privacy and account-boundary risk, especially if users believe the query is handled locally or do not realize their account context may influence or expose data.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This skill forwards arbitrary user input to a third-party service (ChatGPT) through a logged-in browser session without any explicit consent prompt, warning, or policy gate. In the context of an agent skill that may be triggered from natural-language requests, this increases the risk of unintentionally transmitting secrets, personal data, proprietary content, or regulated information to an external provider.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This skill forwards the full user prompt to gemini.google.com through an existing logged-in browser session without any explicit consent, warning, or data-classification guardrails. In an agent setting, users may provide secrets, personal data, or internal information assuming local processing, so silent transmission to a third-party service can cause unintended data disclosure.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script launches Chrome with a persistent profile and an exposed DevTools remote debugging port, then explicitly instructs the user to log into a Google account. Any local process able to reach localhost:PORT can attach via CDP and inspect pages, cookies, storage, and authenticated browser state, which can enable session hijacking or data exfiltration. In the context of a skill designed to automate ChatGPT/Gemini in a real signed-in browser, this materially increases risk because the browser is intentionally used for privileged authenticated sessions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.