Security audit

qa-browser-tester

Security checks for vulnerabilities and agentic risk

Overview

This QA skill does what it claims, but it can install software, disable browser isolation, click and submit real app controls, and expose screenshots without enough user control or warnings.

Install only if you intend to run active end-to-end tests in an authorized, disposable staging environment. Do not use it against production, third-party, admin, financial, or sensitive authenticated sessions unless you add strict allowlists, a dry-run mode, confirmation before submissions/clicks, safer dependency setup, sandboxed non-root browser execution, and private handling or cleanup of screenshots.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: references/test-phases.md:145
Finding: Unrestricted Automation Can Trigger Destructive Application Actions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:82
Finding: Chromium Security Sandbox Is Unconditionally Disabled
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:53
Finding: Mutable External Installers and Unpinned Dependencies Are Executed at Runtime
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/test-phases.md:100
Finding: Discovered Navigation Links Are Followed Without Origin or Network Restrictions
Content: View full analysis
els.map(e => ({text: e.innerText.trim(), href: e.href}))" ) for j, sub in enumerate(sub_links): sub_href = sub.get("href", "") if sub_href and sub_href not in visited_urls and not sub_href.startswith("mailto"): visited_urls.add(sub_href) if safe_goto(page, sub_href, f"sub/{sub.get('text','')}"): shot(page, f"nav_{i}_sub_{j}_{sub.get('text','')[:15]}") ``` ### Technical Analysis The script follows absolute URLs extracted from application-controlled markup without validating the URL scheme, hostname, port, resolved IP address, or relationship to `BASE_URL`. Excluding only `mailto:` and `#` links does not prevent cross-origin navigation or access to localhost, private, link-local, or cloud metadata networks. Because the browser runs inside the Agent environment, it may have network access that external users do not. A target page can therefore direct the automation toward unintended services. ### Attack Path 1. An application page contains a navigation or submenu link to an attacker-selected URL. 2. The Skill extracts the resolved `href`. 3. The link passes the limited checks because it is not empty, `mailto:`, or `#`. ...[truncated 722 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/test-phases.md:31
Finding: Full-Page Screenshots Can Be Copied Into a Web-Accessible Directory Without Redaction
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are broad enough to match common requests like 'check if everything works' or 'browse the website automatically,' causing the skill to activate in many benign contexts. Because the skill performs exhaustive interaction and can modify the host by installing software, overbroad triggering materially increases the chance of unintended execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This script does not merely observe application behavior; it fills forms, submits them, creates accounts, attempts login/logout flows, and clicks arbitrary buttons. Without a prominent warning, a user may run it against production or third-party systems and unintentionally trigger state-changing actions, data creation, emails, purchases, or destructive workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill advertises exhaustive clicking, form filling, and full user-journey simulation without warning that this can submit data, trigger side effects, alter application state, or interact with production systems. In context, the absence of a user-facing warning makes accidental destructive testing more likely.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs collection of broad host-environment details before QA begins, including OS, container status, user identity, package managers, installed runtimes, browser binaries, disk state, and outbound connectivity. This exceeds the minimum needed for app testing and creates unnecessary system reconnaissance that could expose sensitive infrastructure details or normalize host inspection in response to ordinary QA requests.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill includes package installation, dependency bootstrapping, and fetching remote installer code to modify the host environment. For a QA skill, this is dangerous because a routine testing request can trigger persistent system changes, external downloads, and execution of unpinned software, increasing supply-chain and environment-integrity risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructions perform apt/apk installs, pip installs, Playwright browser downloads, and even bootstrap pip from the internet, yet provide no explicit warning that the host will be modified. This omission is particularly dangerous because users invoking a QA skill may not expect privileged package operations or network retrieval of executable dependencies.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script captures full-page screenshots throughout navigation and testing, but the documentation does not warn that these artifacts may contain credentials, personal information, session state, or confidential application content. Combined with later instructions to copy artifacts elsewhere, this increases privacy and integrity risk because sensitive data may be retained or redistributed without operator awareness.
Content: No source excerpt is available for this finding.

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 85% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/test-phases.md (reported line 210)May include surrounding context.
md
name = inp.get_attribute("name") or inp.get_attribute("placeholder") or "field" inp.fill(f"Test {name}") except Exception as e: print(f" ⚠️ Could not fill input: {e}") shot(page, f"form_{fi}_filled")

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation explicitly instructs copying screenshots generated during QA runs into a web-served directory. Because those screenshots may contain authenticated pages, personal data, admin views, or internal application state, publishing them via a web-accessible path can cause unintended data exposure unrelated to the testing function itself.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The skill stores screenshots locally without warning that captures may contain sensitive application data, credentials, personal information, or internal UI state. While lower severity than the installation and reconnaissance issues, silent artifact creation can still create privacy and retention risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: This markdown file provides commands that install packages, install browser dependencies, and export environment variables, which can modify the container environment. The file presents these actions as operational steps but does not include a user-facing warning about their impact on the system state.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest describes a skill for browser-based end-to-end QA testing. While Docker-specific browser flags are clearly in scope, this section recommends running subprocess.run(['free', '-m']) to inspect system memory, which adds a host-level command execution capability beyond direct browser automation. That capability is only tangentially related to QA and is not declared in the manifest description itself.
Content: No source excerpt is available for this finding.