Silmaril Ranger

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:20 PM UTC
• Version: 1.0.2

Overview

This skill is a disclosed browser automation helper, but it asks agents to install and run an unpinned external toolkit with powerful page-script and proxy controls.

Review this before installing. Use it only for trusted local browser automation, avoid authenticated or sensitive pages unless you explicitly need those capabilities, install the toolkit from a pinned and reviewed revision, and do not rely on PATH fallback for silmaril.cmd. Keep proxy listeners on loopback and treat eval-js and MITM proxy use as manual approval actions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:20

Finding

Unpinned Remote Toolkit Retrieval Followed by Local Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-36; additional execution guidance at references/command-patterns.md:5-11
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

SKILL.md:20-36:

markdown

Only clone or copy the toolkit after the user explicitly approves fetching or installing remote code.

1. Clone or copy the repository:

   `git clone https://github.com/Malac12/CDP-tools.git "D:\silmairl cdp"`

2. Ensure Chrome, Chromium, or Edge is installed.

   The toolkit checks standard Windows install paths and falls back to `chrome.exe` on `PATH`.

3. Run the toolkit from PowerShell:

   `& 'D:\silmairl cdp\silmaril.cmd' openbrowser --json`
   `& 'D:\silmairl cdp\silmaril.cmd' openUrl 'https://example.com' --json`
   `& 'D:\silmairl cdp\silmaril.cmd' get-text 'body' --json`

This is sufficient for the core CDP workflow. No machine-wide PowerShell execution policy change is required because `silmaril.cmd` invokes PowerShell with `ExecutionPolicy Bypass`.

references/command-patterns.md:5-11:

markdown

Use the checked-out toolkit directly:

```powershell
& 'D:\silmairl cdp\silmaril.cmd' openbrowser --json
& 'D:\silmairl cdp\silmaril.cmd' openUrl 'https://example.com' --json

If the checkout is not present at that path, resolve silmaril.cmd from PATH or the local workspace before proceeding.

text

### Technical Analysis

The skill directs the agent to clone a mutable external GitHub repository and subsequently execute `silmaril.cmd`. It does not pin the repository to an immutable commit, verify a cryptographic checksum or signature, or require review of the downloaded files before execution. Consequently, the code that executes can differ from the code assessed when this skill was reviewed.

Explicit user approval makes the download more visible, but it does not verify the integrity or trustworthiness of the resulting p
...[truncated 2418 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor the required toolkit implementation into the reviewed skill package so that the executed code is included in the audit boundary.
2. If remote retrieval is unavoidable, pin the repository to a specific immutable commit hash rather than cloning the mutable default branch.
3. Publish an expected cryptographic digest from an independently trusted source and verify all downloaded artifacts before execution.
4. Prefer signed releases and validate the signature against a pinned, trusted maintainer key.
5. Abort installation on any commit, signature, or checksum mismatch.
6. Remove the generic PATH and nearby-workspace fallback. Require a canonical absolute path and verify that the resolved file is located beneath the expected installation directory.
7. Review the command wrapper and all transitively invoked scripts before first execution.
8. Avoid ExecutionPolicy Bypass where possible. If it is operationally necessary, restrict it to a verified script and a narrowly scoped process.
9. Run the toolkit as a non-administrative user in an isolated environment with access limited to the browser profile, files, and network destinations needed for the task.
10. Preserve explicit user approval, but display the pinned source revision and verification result as part of the approval request.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

- Use either `--target-id` or `--url-match` when multiple tabs exist; never use both together.
- Pass `--yes` for page actions and mutations such as `click`, `type`, `set-text`, `set-html`, and `eval-js`.
- Treat `eval-js`, `proxy-override`, `proxy-switch`, and `openurl-proxy` as high-risk commands.
- Use `--allow-unsafe-js` for `eval-js`, or set `SILMARIL_ALLOW_UNSAFE_JS=1` only for a trusted local session.
- Use `--allow-mitm` for proxy commands, or set `SILMARIL_ALLOW_MITM=1` only for a trusted local session.
- Keep proxy listeners on loopback addresses unless the user explicitly requests `--allow-nonlocal-bind`.
- Put long JavaScript in a file and use `eval-js --file` instead of pasting large inline expressions.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This example explicitly normalizes use of eval-js with --allow-unsafe-js, which enables arbitrary JavaScript execution in the controlled browser context. In a browser-automation skill, that can be abused to read sensitive page data, alter application state, or chain into more dangerous workflows, especially if an agent follows examples mechanically.

Content

Scanner excerpt · references/command-patterns.md (reported line 47)May include surrounding context.

Prefer inline eval-js only for short expressions:

powershell

& 'D:\silmairl cdp\silmaril.cmd' eval-js "document.title" --allow-unsafe-js --yes --json

Prefer file mode for longer logic:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This pattern writes a JavaScript file and then executes it with --allow-unsafe-js, making arbitrary multi-line script execution a documented workflow rather than an exceptional break-glass action. File-based execution increases capability and persistence compared with a short inline expression, making misuse easier for data extraction, DOM tampering, or scripted interaction with authenticated sessions.

Content

Scanner excerpt · references/command-patterns.md (reported line 54)May include surrounding context.

powershell

Set-Content -LiteralPath 'C:\Users\hangx\silmaril-expr.js' -Encoding UTF8 -Value "JSON.stringify(Array.from(document.querySelectorAll('a[href]')).map(a => a.href))"
& 'D:\silmairl cdp\silmaril.cmd' eval-js --file 'C:\Users\hangx\silmaril-expr.js' --allow-unsafe-js --yes --json

High-risk rule:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The high-risk rules describe multiple dangerous bypass mechanisms: unsafe JS execution, MITM proxy enablement, and broader network binding via environment variables or flags. In the context of a browser/CDP automation skill, this materially increases risk because an agent could be steered into intercepting traffic, exposing local listeners, or executing arbitrary page scripts against sensitive authenticated sessions.

Content

Scanner excerpt · references/command-patterns.md (reported line 59)May include surrounding context.

md

High-risk rule:

- `eval-js` requires `--allow-unsafe-js` unless `SILMARIL_ALLOW_UNSAFE_JS=1` is already set for a trusted local session.
- Proxy commands require `--allow-mitm` unless `SILMARIL_ALLOW_MITM=1` is already set for a trusted local session.
- Proxy listeners stay loopback-only unless `--allow-nonlocal-bind` is explicitly requested.