T07 · Tool Hijacking and Spoofing
Error
- Location
SKILL.md:25- Finding
Unverified External Browser-Control Fallback Can Be Hijacked
- Content
View full analysis
- Remediation
View remediation
Security audit
Chrome Mcp
Security checks for vulnerabilities and agentic risk
Overview
This skill openly controls a real logged-in Chrome session, but it gives broad account-access and state-changing browser instructions without enough user confirmation or fallback-tool integrity safeguards.
Review before installing. Use this only with a browser profile you are comfortable delegating to an agent, preferably a separate limited-privilege profile. Do not let it access private accounts, messages, financial/workplace sites, or perform posts/deletions unless you explicitly confirm the exact account, target, and action. Avoid the external fallback unless you have independently verified that script.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:49- Finding
Authenticated State-Changing Browser Actions Lack Mandatory Confirmation Boundaries
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill emphasizes controlling a real already logged-in Chrome session and any site requiring login, but it omits warnings about privacy, account access, and sensitive data exposure. This is especially dangerous because the agent may inherit access to private messages, financial, workplace, or personal accounts without users appreciating the scope of delegated access.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill provides direct instructions for destructive actions such as deleting posts and undoing reposts without any warning, confirmation, or verification of user intent. In a real authenticated session, this enables irreversible or reputation-impacting actions to occur too easily, especially if triggered by ambiguous prompts or agent error.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language content of the skill is entirely in Chinese, and there is no indication that the language is optional, user-selectable, or required for a region-specific purpose. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger examples are extremely broad everyday requests like opening sites or checking messages, which can cause this high-risk skill to activate in routine contexts without clearly signaling that it will control a real logged-in browser session. Because the skill can read and act within authenticated sessions, broad invocation language increases the chance of unintended account access or sensitive browsing actions.
- Content
Static analysis
No suspicious patterns detected.