Brower Opener

• Outcome: Review
• Latest audit: Jun 16, 2026 · 2:23 PM UTC
• Version: 1.0.1

Overview

This skill is a real Chrome automation helper, but it defaults to exposing logged-in browser sessions through a local debugging port with limited consent and cleanup controls.

Install only if you specifically need Chrome DevTools/Playwright automation with reused login state. Prefer independent mode, avoid using personal or production accounts, close the debug browser when finished, and be aware that local tools connecting to port 9222 may control pages in the launched browser.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 启动 Chrome（非阻塞）
    try:
        if system == "windows":
            subprocess.Popen(
                cmd,
                creationflags=creation_flags,
                stdout=subprocess.DEVNULL,

• Confidence: 94% confidence
• Finding: The script launches Chrome with `--remote-debugging-port=9222`, exposing a DevTools control endpoint that can allow page inspection, cookie/session access, script execution, and browser automation by other local processes or potentially remote parties if network exposure occurs. In this skill's context, the tool is explicitly designed for cookie/session reuse, which makes the debugging endpoint especially sensitive because it can expose authenticated browser state.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

start_new_session=True
            )
        else:
            subprocess.Popen(
                cmd,
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,

• Confidence: 94% confidence
• Finding: This non-Windows launch path also starts Chrome with a remote debugging port, creating a browser control surface that can expose live tabs, session data, and authenticated actions. Because the skill is intended to reuse cookies/sessions, misuse of the DevTools endpoint could directly compromise user accounts or sensitive browsing data.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

pass
    else:
        try:
            subprocess.run(
                ["pkill", "-9", "-f", "Google Chrome"],
                capture_output=True,
                timeout=10

• Confidence: 76% confidence
• Finding: The script forcibly kills processes matching `Google Chrome` with `pkill -9 -f`, which is overly broad and may terminate unrelated processes whose command line contains that string. In an agent skill context, this can cause denial of service, data loss in active browser sessions, and unsafe interference with the user's environment without confirmation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 启动 Chrome（非阻塞）
    try:
        if system == "windows":
            subprocess.Popen(
                cmd,
                creationflags=subprocess.CREATE_NEW_PROCESS_GROUP,
                stdout=subprocess.DEVNULL,

• Confidence: 94% confidence
• Finding: This Windows launch path in reuse mode opens Chrome with remote debugging enabled against the user's main profile context, which materially increases the risk of session theft and unauthorized browser control. Since the advertised purpose includes cookie/session reuse, compromise of the debug endpoint could expose highly sensitive authenticated data.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

start_new_session=True
            )
        else:
            subprocess.Popen(
                cmd,
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,

• Confidence: 95% confidence
• Finding: This launch path enables remote debugging for the copied/default-profile workflow on Unix-like systems, exposing browser state from a profile derived from the user's real Chrome data. That makes the endpoint especially dangerous because cookies, saved sessions, and open-site context may be available to any process that can reach the port.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs execution of shell commands, network access to a local DevTools endpoint, and use of scripts that can alter local state, yet it declares no permissions. This creates a transparency and policy-enforcement gap: an agent or reviewer may treat the skill as lower risk than it is, while it can still launch processes, kill conflicting processes, and interact with browser-debugging surfaces.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The documentation claims independent mode is incognito, but the code actually uses a persistent `--user-data-dir`, which stores browsing state on disk. This mismatch can mislead users into believing activities are private when they are not, causing accidental retention of sensitive cookies, history, or credentials.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The CLI help and examples reinforce the false claim that independent mode is incognito, increasing the likelihood of unsafe user assumptions. In a browser-launching skill that handles session reuse, misleading privacy guarantees are security-relevant because they affect how users expose authenticated activity.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script indiscriminately kills any process listening on port 9222 using kill -9 or fuser -k, without verifying that the process is the Chrome instance it intends to manage. This grants the skill host-level process termination capability beyond its stated purpose and can disrupt unrelated developer tools, browser sessions, or local services using that port.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly promotes launching Chrome while reusing the user's primary profile cookies, which can expose authenticated sessions, personal browsing state, and sensitive account access to any attached automation or debugging client. In this skill's context, the danger is amplified because the workflow is designed to let other tools connect to that browser and drive actions as the logged-in user, but the documentation provides no warning, consent step, or safer default.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README instructs users to expose a Chrome remote debugging endpoint on 127.0.0.1:9222 without explaining that any local process able to access that port can attach to the browser, inspect pages, extract data, and perform actions in the reused authenticated session. Because this skill combines remote debugging with cookie/profile reuse, the security impact is materially higher than a generic local debug setup.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger phrases are broad, common requests like '打开浏览器' and '启动浏览器', making accidental activation likely during normal conversation. Because activation launches Chrome with remote debugging and potentially session reuse, a simple benign request can escalate into exposing an authenticated browser context to automation.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The activation logic defaults all unspecified cases to cookie-reuse mode without requiring explicit user consent. In context, this is more dangerous because reuse mode preserves authenticated sessions and the skill states the agent can connect to DevTools, which can expose or manipulate sensitive browsing state.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill presents cookie/profile reuse as the default behavior before any prominent privacy warning or consent gate. Given the remote debugging setup, this can expose authenticated sessions, cookies, and browsing context to downstream tools or agents without sufficiently informed user approval.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Reuse mode deletes and recreates `~/.chrome-reuse-profile` automatically without explicit confirmation, which can destroy prior session artifacts and silently handle a copy of the user's main browser profile. In this skill context, that profile may contain cookies and authenticated state, so unmanaged copying/deletion increases privacy and operational risk.

Static analysis

No suspicious patterns detected.