gasbuddy-browser

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 1.0.0

Overview

The skill is aimed at fetching public GasBuddy prices, but it tells the agent to run Playwright through shell execution with Chromium sandboxing disabled.

Review before installing. The skill does not show malicious behavior or hidden persistence, but it asks agents to browse a public website using local shell-driven Playwright with Chromium sandboxing disabled. Use it only in a disposable or well-isolated environment, and prefer removing the no-sandbox flags if your environment supports Chromium sandboxing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25
• Finding: Chromium Sandbox Disabled for Untrusted Web Content## Vulnerability Details **File Location**: `SKILL.md:25-29` **Vulnerability Type**: Browser sandbox disabled through unsafe launch flags **Risk Level**: Medium **Vulnerable Code**: ```javascript const browser = await chromium.launch({ headless: false, args: ['--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage', '--disable-gpu'] // No need for --disable-blink-features=AutomationControlled or custom UA // Cloudflare challenge is time-based, not detection-based }); ``` ### Technical Analysis The Playwright template explicitly passes `--no-sandbox` and `--disable-setuid-sandbox` to Chromium. These flags disable Chromium's primary process-isolation controls while the browser processes scripts and other content supplied by an external website. Disabling the browser sandbox is not required by the skill's stated purpose of collecting public fuel-price data. It unnecessarily weakens the boundary between potentially hostile renderer content and the host environment. Exploitation would still require a suitable Chromium or renderer vulnerability; the flags do not independently grant code execution. ### Attack Path 1. An agent follows the skill and launches Chromium with the documented flags. 2. The unsandboxed browser loads GasBuddy pages and their remote third-party resources. 3. A compromised resource, malicious redirect, or hostile page delivers content that exploits a compatible browser vulnerability. 4. Because Chromium's sandbox has been disabled, successful exploit code may execute with the privileges of the Playwright browser process rather than remaining confined to a renderer sandbox. 5. The attacker may then access resources available to that operating-system account. ### Impact Assessment A successful browser exploit could obtain the privileges of the user running Playwright. Depending on the surrounding execution environment, this may permit access to readable workspace files, environm ...[truncated 341 chars]
• Remediation: ## Remediation Suggestions - Remove `--no-sandbox` and `--disable-setuid-sandbox` from the Chromium launch arguments. - Run Playwright as a dedicated, unprivileged operating-system user in an environment where Chromium sandboxing is supported. - Keep the browser and Playwright runtime patched to reduce exposure to known browser vulnerabilities. - If sandboxing cannot be enabled, place the browser in a disposable container or virtual machine with: - No mounted credentials or sensitive host directories. - A read-only root filesystem where practical. - Dropped Linux capabilities and `no-new-privileges`. - Strict CPU, memory, process, and execution-time limits. - Network egress restricted to the domains necessary for the task. - An ephemeral workspace destroyed after execution. - Document any environment-specific reason for disabling sandboxing and fail safely rather than silently falling back to an unsandboxed browser.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger description is broad enough that the skill may activate for a wide range of user requests about gas prices, browsing, comparisons, or automation. Because this skill explicitly instructs use of Bash exec with Playwright rather than a constrained browser tool, overbroad invocation increases the chance of unnecessary external navigation and script execution in situations where a narrower or safer skill should have been selected.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The script hard-codes `toLocaleDateString('en-CA', ...)`, which imposes a specific language/locale choice in output regardless of the user's preferences. The file does not indicate that this locale is optional or justified as a region-specific compliance requirement.

Static analysis

No suspicious patterns detected.