Security audit

qa-browser-tester

Security checks across malware telemetry and agentic risk

Overview

This browser QA skill is useful, but it can broadly click, submit forms, create accounts, and expose screenshots if run against the wrong site.

Install only if you intend to run automated browser QA in a disposable container or a clearly authorized staging/test environment. Do not point it at production, admin areas, real customer data, or personal accounts unless you accept that it may click controls, submit forms, create accounts, trigger workflows, and save screenshots. Review the install commands and avoid publishing screenshots to a web-served directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The documentation explicitly instructs copying screenshots generated during QA into `/var/www/html/qa/`, making potentially sensitive application data web-accessible. Because the script captures full-page screenshots after navigation, form filling, and authentication flows, those images may contain tokens, PII, internal pages, or security-sensitive states that should not be published.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger conditions are broad enough that the skill may activate for ambiguous requests like 'check if everything works' or 'simulate a user,' causing real browser automation when the user may not have intended invasive testing. In this skill’s context, activation can lead to clicking through production systems, form submission, and screenshot capture, so unintended invocation materially increases risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly instructs exhaustive clicking, form filling, navigation, and screenshot collection without any safeguards for production environments, test accounts, or non-destructive mode. In practice this can create or modify live data, trigger side effects, and capture sensitive information visible in the browser, making the skill materially dangerous in real deployments.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The skill directs the agent to run environment reconnaissance, install packages, fetch code from the internet, and modify the host/container before any explicit user acknowledgement of system changes. This is dangerous because it expands the attack surface, alters the execution environment, and can violate least-privilege or change-management expectations on the server where the skill runs.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: This script performs real state-changing actions against the target application: it clicks every visible button, submits forms, attempts registration and login, and probes protected routes, all without prominent safeguards or warnings. In the context of a browser-testing skill that may be run against production systems, this can create accounts, modify data, trigger workflows, or generate unintended transactions and notifications.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.