Browser CDP Tailnet

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:09 AM UTC
• Version: 1.0.0

Overview

The skill is transparent about connecting to a shared remote browser, but it gives agents broad control over a persistent Chromium session without documented isolation, consent, or safeguards for sensitive browser state.

Only install this if you intentionally want agents to use this exact shared tailnet browser and you trust everyone with access to it. Do not use it for confidential browsing or personal/business accounts unless the browser is isolated per user or task, access is controlled, and session data is cleared after use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:7
• Finding: Unrestricted Shared CDP Browser Exposes Cross-Agent Sessions## Vulnerability Details **File Location**: `SKILL.md`, lines 7–26 **Vulnerability Type**: Shared remote browser access without stated authentication or session isolation **Risk Level**: High ### Vulnerable Code ```markdown Default target: - CDP base URL: `http://100.101.184.33:9223` - Browser WS endpoint: `ws://100.101.184.33:9223/devtools/browser/3fbb2459-85c5-40b5-8d50-6f3c596cf8d5` Preferred connection method: - `chromium.connectOverCDP("http://100.101.184.33:9223")` Hard rules: - Prefer the HTTP CDP base URL over hardcoding the raw WS endpoint when your client supports it. - If `/json/version` reports `ws://localhost/...`, replace `localhost` with `100.101.184.33:9223`. - Verify with a small probe before claiming it works. Known-good checks already observed on this machine: - `/json/version` responded on `http://100.101.184.33:9223` - CDP WebSocket handshake succeeded - `Browser.getVersion` succeeded - live navigation to YouTube succeeded Use this skill instead of local browser skills when the browser should be shared across agents or reached remotely over the tailnet. ``` ### Technical Analysis The skill directs agents to connect to a fixed, persistent Chromium DevTools Protocol endpoint shared across agents. CDP grants extensive control over the connected browser, including the ability to enumerate browser contexts and pages, inspect page content, execute JavaScript, navigate tabs, and interact with authenticated web applications. The documented workflow does not require per-agent authentication, authorization checks, user confirmation, isolated browser profiles, or fresh browser contexts. It also explicitly encourages sharing the browser across agents. Consequently, any agent with network reachability to the endpoint may gain access to browser state created by another agent or user, including open pages, active authenticated sessions, and cookies available through CDP operations. The endpoint us ...[truncated 2121 chars]
• Remediation: ## Remediation Suggestions 1. Replace the unrestricted shared CDP endpoint with an authenticated browser automation gateway that authorizes each requested operation. 2. Require explicit per-use authorization before connecting to an existing remote browser or accessing pre-existing pages. 3. Allocate a fresh browser process, profile, or strongly isolated browser context to each agent and task. 4. Prevent agents from enumerating or attaching to contexts and pages owned by other users or agents. 5. Use short-lived, scoped credentials and ephemeral endpoint identifiers instead of publishing a stable browser WebSocket endpoint. 6. Use encrypted transport, such as TLS-protected HTTPS and WSS, in addition to tailnet network controls. 7. Restrict endpoint reachability with identity-aware access policies and permit only specifically authorized principals. 8. Clear cookies, local storage, caches, downloads, and other browser state when an isolated task ends. 9. Avoid placing privileged or personally authenticated sessions in a browser intended for shared automation. 10. Add access logging, connection auditing, rate limits, and alerts for unexpected context enumeration or attachment. 11. If unrestricted CDP is operationally necessary, dedicate the browser to a single trust domain and document that no sensitive persistent sessions may be used within it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs use of a shared remote Chromium instance over a tailnet endpoint, but it does not warn users that browsing activity, cookies, authenticated sessions, downloads, and page state may be visible to or affected by other users of that browser or the remote host. In this context, the omission is security-relevant because the skill explicitly encourages switching from local browser use to a shared network-accessible browser, increasing the chance of unintended data exposure or session cross-contamination.

Static analysis

No suspicious patterns detected.