T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:33- Finding
Sensitive form values are disclosed in process output
- Content
View full analysis
- Remediation
View remediation
Security audit
Browser Agent
Security checks for vulnerabilities and agentic risk
Overview
This browser automation skill matches its stated purpose, but it can expose typed form values and persist login session data without adequate safeguards.
Review before installing. Avoid passing passwords, tokens, payment details, or other secrets through --fill because they may be printed in command output. Treat saved session files as secrets, keep them in a protected location, do not share them, and avoid loading old session state unless you are certain which account and site it belongs to.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md ## Workflow 1. Run `index.js` with a target URL. 2. Use action flags to open, screenshot, extract title/text, click selectors, fill inputs, or save/load session state. 3. Keep selectors explicit when clicking or filling. 4. Save evidence (screenshots / extracted text) to `out/`.
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md ## Workflow 1. Run `index.js` with a target URL. 2. Use action flags to open, screenshot, extract title/text, click selectors, fill inputs, or save/load session state. 3. Keep selectors explicit when clicking or filling. 4. Save evidence (screenshots / extracted text) to `out/`.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly supports saving and loading cookies and storage state but provides no warning about the sensitivity of those artifacts. Reusing persisted browser state can expose session tokens, leak private data, or cause actions to run under the wrong authenticated context, especially in an automation environment where outputs may be reused or shared.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This skill can persist the browser storage state to an arbitrary filesystem path, which typically includes cookies and other authenticated session artifacts. In a browser automation skill, that creates a real risk of credential/session-token leakage or unintended long-term retention if the caller saves state from sensitive sites and later exposes or reuses the file.
- Content
Static analysis
No suspicious patterns detected.