Browser Auth

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:10 PM UTC
• Version: 1.6.0

Overview

This skill has a coherent browser-login purpose, but it exposes a highly sensitive remote browser and saved session secrets with misleading defaults and weak containment.

Install only if you are comfortable giving this skill control of a browser login and producing reusable session secrets. Run it in an isolated VM or container, set AUTH_HOST=127.0.0.1 explicitly, use a trusted encrypted tunnel for any remote access, avoid untrusted proxies, protect and delete the session file immediately after use, and do not share the printed token URL through logs or insecure channels.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/auth_server.js:134

Finding

Public Default Binding and Plaintext Bearer-Token Transport

Content

View full analysis

Vulnerability Details

File Location: scripts/auth_server.js, lines 134-140
Vulnerability Type: Insecure network exposure and sensitive token transmission
Risk Level: High

javascript

if (require.main === module) {
    const args = process.argv.slice(2);
    const port = parseInt(args[0]) || 19191;
    const sessionFile = args[1] || 'session.json';
    const host = process.env.AUTH_HOST || '0.0.0.0';
    const token = process.env.AUTH_TOKEN || crypto.randomBytes(16).toString('hex');
    startServer({ port, host, sessionFile, token });
}

The generated access URL is also explicitly printed using plaintext HTTP:

javascript

const displayHost = host === '0.0.0.0' ? 'YOUR_IP' : host;
console.log(`\n🚀 BROWSER AUTH SERVER READY`);
console.log(`Access Link: http://${displayHost}:${port}/?token=${token}\n`);

Technical Analysis

When the script is executed directly, it binds to 0.0.0.0 unless AUTH_HOST is explicitly configured. This exposes the browser-control service on every available network interface and contradicts the documented secure default of 127.0.0.1.

Authentication depends on a bearer token included in the URL query string. The generated URL uses unencrypted HTTP. Although the application sets a no-referrer policy and removes the token from the browser address bar after loading, these measures do not prevent interception over the network. Query-string tokens may also be exposed through browser history, copied URLs, reverse-proxy logs, monitoring systems, or console logs.

An authenticated Socket.IO client can receive browser screenshots, send keyboard input, navigate the browser, and request session capture. Consequently, disclosure of this token grants substantial control over an authentication session.

Attack Path

1. An operator starts auth_server.js without explicitly setting AUTH_HOST.
2. The service listens on 0.0.0.0, making it reachable through a ...[truncated 919 chars]

Remediation

View remediation

Remediation Suggestions

• Change the direct-execution default from 0.0.0.0 to 127.0.0.1.
• Require an explicit unsafe-network override before permitting a non-loopback bind address.
• Do not expose the service directly to an untrusted network; require an authenticated SSH, VPN, or similarly protected tunnel.
• Terminate TLS before any remote access and reject plaintext remote connections.
• Replace query-string authentication with a short-lived, single-use credential delivered through a protected mechanism.
• Expire the token after the first successful client connection or after a short timeout.
• Avoid printing complete bearer tokens to shared logs.
• Add connection rate limiting and audit logging without recording credentials.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/auth_server.js:112

Finding

Sensitive Session Credentials Written Without Restrictive File Protections

Content

View full analysis

Vulnerability Details

File Location: scripts/auth_server.js, lines 112-117
Vulnerability Type: Insecure storage of authentication material
Risk Level: High

javascript

socket.on('done', async () => {
    const cookies = await context.cookies();
    const storage = await page.evaluate(() => JSON.stringify(localStorage));
    fs.writeFileSync(sessionFile, JSON.stringify({ cookies, storage }, null, 2));
    console.log(`[OK] Session saved to ${sessionFile}`);
    socket.emit('captured', { success: true });
});

Technical Analysis

The application writes active browser cookies and local-storage values to a plaintext JSON file. These values may include reusable session identifiers, bearer tokens, and other account authentication material.

fs.writeFileSync() is called without an explicit restrictive file mode, so effective permissions depend on the process umask and preexisting destination permissions. The output path is also supplied through a command-line argument without validation. The implementation does not constrain the file to a controlled directory, reject symbolic links, prevent overwriting an existing file, or create the result atomically.

If the process runs in a shared environment or under an unsafe umask, another local user or process may be able to read the exported credentials. If an attacker can prepare the destination path or a symbolic link, the operation may overwrite a file writable by the server process.

Attack Path

1. The server is started with a predictable or attacker-influenced session-file path.
2. A user completes authentication in the controlled browser.
3. The done event exports active cookies and local storage.
4. The data is written in plaintext using ambient filesystem permissions.
5. A local attacker reads the resulting file, or uses a pre-positioned symbolic link to redirect the write.
6. The attacker imports or otherwise reuses the captured credent ...[truncated 428 chars]

Remediation

View remediation

Remediation Suggestions

• Create the session file with mode 0600 and ensure its parent directory is accessible only to the service account.
• Open the destination with exclusive-creation semantics so an existing file is not silently overwritten.
• Reject symbolic links and verify the final resolved destination before writing.
• Restrict output to a dedicated, securely created directory rather than accepting arbitrary paths.
• Write to a securely created temporary file and atomically rename it after successful serialization.
• Minimize exported data and avoid saving local-storage values unless they are required.
• Encrypt session artifacts at rest when they must persist.
• Delete session artifacts immediately after their intended use and document an enforceable retention period.
• Run the service as a dedicated, unprivileged operating-system account.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/auth_server.js:104

Finding

Unrestricted Browser Navigation Enables Authenticated Internal-Network Access

Content

View full analysis

Vulnerability Details

File Location: scripts/auth_server.js, lines 104-110
Vulnerability Type: Unrestricted destination access and visual server-side request forgery
Risk Level: High

javascript

socket.on('goto', async ({ url }) => {
    try {
        const target = url.startsWith('http') ? url : `https://${url}`;
        if (!target.startsWith('http')) return;
        await page.goto(target);
        await sendScreenshot();
    } catch (e) { console.error('Goto error:', e.message); }
});

Technical Analysis

An authenticated Socket.IO client can instruct Chromium to visit an arbitrary URL. The startsWith('http') checks do not impose a meaningful destination policy. They do not block loopback addresses, private network ranges, link-local services, internal DNS names, or destinations reached through redirects.

The navigation originates from the host running Chromium rather than from the remote client. The client then receives a screenshot of the resulting page. This makes the browser service a visual server-side request forgery and internal-network reconnaissance channel.

Token authentication limits this operation to clients possessing the tunnel token, but token compromise remains plausible because the same service is exposed through a URL bearer token and may use plaintext HTTP. No additional destination authorization is enforced.

Attack Path

1. An attacker obtains a valid authentication token and connects to Socket.IO.
2. The attacker emits a goto event containing a loopback, private, link-local, or internal hostname URL.
3. Chromium resolves and requests that destination from the server host's network context.
4. The server captures the rendered result.
5. The screenshot is sent to the attacker.
6. The attacker repeats the process to enumerate internal services or interact with reachable web interfaces using mouse and keyboard events.

Redirects from an initially public ...[truncated 553 chars]

Remediation

View remediation

Remediation Suggestions

• Parse destinations with new URL() and allow only explicitly supported protocols, such as https:.
• Require an explicit allowlist of authentication domains rather than allowing arbitrary destinations.
• Resolve hostnames and block loopback, private, link-local, multicast, reserved, and metadata-service address ranges for both IPv4 and IPv6.
• Revalidate every redirect destination and protect against DNS rebinding.
• Block navigation to hostnames such as localhost and internal-only DNS suffixes.
• Apply browser-level request interception so subresources, pop-ups, frames, and subsequent navigations follow the same policy.
• Use network isolation or firewall rules to prevent the Chromium process from reaching internal management networks.
• Associate each short-lived authorization token with a fixed set of permitted destination origins.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-20
Vulnerability Type: Uncontrolled third-party dependency installation
Risk Level: Medium

json

{
  "id": "npm-deps",
  "kind": "exec",
  "command": "npm install express socket.io playwright-core",
  "label": "Install Node.js dependencies"
}

Technical Analysis

The installation command retrieves three packages without exact versions, a committed lockfile, or explicit integrity verification. Consequently, package resolution can change over time and may install future releases that were not part of the reviewed artifact.

This creates a supply-chain exposure and makes installations non-reproducible. The available evidence does not show that any named dependency is currently malicious. The issue is that the Skill automatically trusts mutable registry state and uncontrolled transitive dependency resolution.

Depending on npm configuration and package metadata, installation may also execute dependency lifecycle scripts under the privileges of the installation process.

Attack Path

1. The Skill installation process executes the documented npm install command.
2. npm resolves the latest versions and their transitive dependencies from the configured registry.
3. A compromised package release, registry account, registry response, or future malicious dependency version is selected.
4. Package code or an installation lifecycle script executes locally.
5. The malicious dependency gains the filesystem, network, and process privileges of the user performing installation.

Impact Assessment

A compromised dependency could execute arbitrary code with the privileges of the installer or runtime account. Potential consequences include credential theft, modification of project files, session artifact theft, persistence within writable user locations, and network exfiltration. No actual dependency compromise was identified in the reviewed fil ...[truncated 72 chars]

Remediation

View remediation

Remediation Suggestions

• Add a reviewed package.json with exact or tightly constrained dependency versions.
• Commit a generated package-lock.json containing integrity hashes.
• Replace the mutable installation command with npm ci.
• Review transitive dependencies and npm lifecycle scripts before release.
• Use automated dependency scanning and timely, reviewed security updates.
• Configure the expected registry explicitly and enforce package provenance where supported.
• Perform installation under a dedicated, unprivileged account and avoid granting unnecessary filesystem access.
• Consider disabling lifecycle scripts during installation when they are not required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill markets itself as a secure remote browser tunnel for manual authentication and session capture, but the described/code behavior appears inconsistent with that claim. Security-relevant description/behavior mismatch is dangerous because operators may trust the skill with high-value login flows and session cookies under false assumptions, leading to misuse, unsafe deployment, or exposure of authentication material.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares environment-variable capabilities but does not define any explicit tool scope such as permissions or allowed-tools. In a skill that handles authentication tokens and session artifacts, missing scope boundaries increases the risk of over-broad execution or unintended access to sensitive data by the agent runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The UI sends clicks, keystrokes, pasted text, and navigation commands over a remote socket connection, but it does not clearly warn the user that all entered data may be transmitted to and captured by the remote browser session. In a skill explicitly designed for authentication and session capture, this increases the risk that users unknowingly submit passwords, 2FA codes, or sensitive clipboard contents to a remote system without informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The socket handlers expose broad remote browser control primitives including arbitrary navigation, typing, key presses, and mouse clicks, which goes beyond a narrowly scoped authentication helper. In this skill’s context, that means anyone with the token can drive a full browser session to arbitrary sites and potentially abuse captured authenticated state, making the service a reusable remote browsing/control channel rather than a limited login aid.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The server continuously captures and transmits screenshots of the browser over the socket, which can expose credentials, one-time codes, personal data, and account contents without explicit notice. Even with token gating, this creates a high-sensitivity surveillance channel during authentication flows, especially if the link is shared, logged, or intercepted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code writes cookies and localStorage directly to disk on a remote event, creating a persistent artifact containing authenticated session secrets. In this skill’s context, those secrets are the intended product of the workflow, so insecure storage or silent capture can directly enable account takeover or reuse of authenticated sessions by other local users, malware, or downstream automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script loads session cookies from disk, injects them into a browser context, and then visits a caller-supplied URL. In the context of a browser-auth skill designed to capture and reuse authenticated sessions, this can leak or misuse authenticated state by sending cookies to attacker-controlled or unintended destinations, enabling account access validation, session replay, or authenticated actions without clear user consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code claims Chromium sandboxing is always enabled, but the launch options do not actually enforce sandboxing; they only disable first-run behavior and the zygote process. This is dangerous because a misleading security comment can cause operators to trust an isolation boundary that may not exist in the runtime environment, increasing exposure if hostile web content is loaded during session verification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The documentation frames this as a secure manual authentication tunnel, but the implementation uses a headless browser and broad remote-control semantics, which undermines user awareness and the claimed trust model. That mismatch is dangerous because operators may assume a constrained, user-visible flow while the code actually enables hidden automation and session capture capabilities.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The code accepts an external proxy from environment and silently routes browser traffic through it, which can redirect sensitive authentication traffic and session activity through untrusted infrastructure. In a tool designed to handle logins, 2FA, and session capture, this materially increases the risk of credential interception, traffic observation, or policy bypass.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.