Open Chrome Tabs

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:09 PM UTC
• Version: 1.1.1

Overview

This skill clearly does what it claims, but it asks users to run an unpinned third-party npm tool that reads sensitive browser tab and sync data.

Review this before installing. Only run it if you trust the npm package publisher and are comfortable exposing local and synced browser tab data. Prefer a pinned, reviewed package version, avoid running with elevated privileges, and limit use to the specific browser profile or device you need.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Execution of an Unpinned Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–10
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code:

markdown

Install once: `npm install -g @mindsocket/chrome-open-tabs`

Or one-off: `npx @mindsocket/chrome-open-tabs ...`

Technical Analysis

The documented commands install or immediately execute @mindsocket/chrome-open-tabs without specifying an audited version or integrity value. Consequently, npm resolves a mutable package release from an external registry. The npx command is particularly sensitive because it can download and execute the currently published package without a separate review step. A global installation can also make the dependency available beyond the immediate Skill invocation.

The package implementation is not included in the audited project, so its lifecycle scripts and runtime behavior cannot be verified from the available source. This finding does not establish that the current package is malicious; the vulnerability is the unsafe trust placed in a mutable external dependency. Exploitation requires compromise of the package, its publisher account, the registry resolution process, or a future package release.

Attack Path

1. An attacker compromises the npm publisher account, package distribution channel, or a future release of @mindsocket/chrome-open-tabs.
2. The attacker publishes a modified package version containing malicious lifecycle or runtime code.
3. A user follows the Skill instructions and runs either the unpinned global installation or the npx command.
4. npm resolves and downloads the attacker-controlled release because no exact version or integrity constraint is specified.
5. Malicious code executes with the operating-system privileges of the invoking user.
6. Because the tool's intended function involves Chromium profile directories, session files, synchronization databases, open URLs, an ...[truncated 856 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, exact version rather than allowing npm to resolve the latest release.
2. Record and verify package integrity using a lockfile and npm integrity metadata.
3. Prefer a project-local installation over a global installation to constrain dependency scope and improve reproducibility.
4. Avoid ad hoc npx execution of an unreviewed mutable package. Use a locally installed, locked dependency and invoke its checked binary instead.
5. Review and vendor the required package source when feasible, including lifecycle scripts and transitive dependencies.
6. Run the tool without elevated privileges and limit filesystem and network access through sandboxing where practical.
7. Require explicit user consent before accessing Chromium profile, synchronization, session, URL, or device data.
8. Establish a dependency-update process in which new releases are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says the skill can read currently open tabs and synced-device tabs, but it does not clearly warn that this may reveal highly sensitive browsing history, account context, work activity, or tabs from other devices. Because the capability targets browser sync/session data directly, insufficient disclosure can cause users to authorize or invoke it without understanding the privacy impact.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill recommends executing a package via npx without pinning an exact version, which creates a supply-chain risk: users may fetch whatever version is current at execution time, including a compromised or malicious release. In this skill’s context, that risk is amplified because the tool accesses sensitive browser tab and sync data, so a malicious package update could exfiltrate browsing activity across devices.

Content

No source excerpt is available for this finding.