Security audit

CDP Bridge MCP Browser Control

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate browser-control skill, but it needs Review because it can operate a live logged-in browser, read cookies, capture page data, and run JavaScript without clear consent boundaries.

Install only if you intentionally want an agent to operate your real browser. Prefer a separate browser profile, avoid sensitive accounts, approve cookie reads and screenshots only for a specific site and purpose, and review any JavaScript, navigation, or batch action before it runs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill description uses broad trigger language like '控制浏览器', '读取网页内容', and '执行浏览器操作', which can match many ordinary user requests and cause this high-privilege skill to be invoked when not strictly necessary. In this skill's context, mis-invocation is especially dangerous because the exposed actions include controlling a real logged-in browser session, executing JavaScript, taking screenshots, and reading cookies.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The '快速判断' section instructs invocation based on vague phrases and even explicitly targets requests involving an already logged-in real browser session. That makes accidental routing likely for normal browsing-related prompts, increasing the chance that the agent performs sensitive actions against a user's live browser without a clearly bounded request.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The description advertises the ability to read cookies, execute JavaScript, and control an installed browser plugin against a real browser session, but it does not warn that these actions can expose authenticated data, perform account actions, or modify page state. In a skill explicitly designed to operate a live browser, the absence of consent and risk language materially increases the chance of unsafe or privacy-invasive use.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The tool list exposes sensitive capabilities such as cookie retrieval, arbitrary JavaScript execution, screenshots, navigation, and batch commands, yet provides no safety notes about privacy, persistence, side effects, or the risk of acting on behalf of a logged-in user. Because these are not passive read-only operations, omission of warnings and gating makes misuse and overreach substantially more dangerous in this context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The examples explicitly demonstrate reading browser cookies, including for a specified URL, without any warning that cookies may contain authentication tokens or session identifiers. In the context of a browser-control skill, this materially increases risk because the capability can expose live session data from a real user browser and enable account takeover if mishandled or exfiltrated.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The JavaScript execution examples show arbitrary script execution in the browser, including a button click, without warning that this can submit forms, change account settings, trigger purchases, or otherwise alter remote state. In this skill's context of controlling a real browser, omission of safety guidance is significant because the documented capability can directly act within authenticated sessions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly exposes a capability to read browser cookies, which can include session identifiers and other authentication material, yet the documentation provides no warning, consent boundary, or restriction guidance. In the context of a browser-control bridge for a real user browser, this materially increases the risk of account takeover, privacy violations, and cross-site data exfiltration if the tool is misused or invoked with insufficient safeguards.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The page scanning feature can return full page text or simplified HTML from a live browser tab, but the documentation does not warn that scanned content may contain credentials, personal data, financial information, or internal business data. Because this skill is designed to operate on a real browser with arbitrary tabs, omission of such warnings makes accidental sensitive data collection and disclosure more likely.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Allowing arbitrary JavaScript execution in a real browser tab is a high-risk capability because it can click buttons, submit forms, alter settings, extract DOM data, and trigger irreversible user actions. The documentation presents this as a normal feature without warning about destructive operations, consent expectations, or restrictions, which is unsafe given the tool's ability to control an already-authenticated browser session.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.