Security audit

Browser Agent Bridge CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned but gives an agent broad read and control access to a live Chrome session with weak setup safeguards.

Review before installing. Only use this with tabs you intend the agent to inspect or control, generate fresh random tokens instead of copying the examples, keep the bridge bound to localhost, stop the server and disable the extension when finished, and prefer pinned, verified releases of the CLI and extension.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:53
Finding: Unpinned Third-Party CLI and Browser Extension Supply Chain
Content: View full analysis
Remediation: View remediation
' ``` 2. Publish and verify cryptographic hashes or signed release artifacts before installation. 3. Pin the extension to an audited Git commit or signed release archive rather than instructing users to load the repository's current state. 4. Document the expected extension file hashes and require verification before loading it into Chrome. 5. Review and document the extension manifest, host permissions, and content-script scope. Grant only the minimum permissions necessary. 6. Remove or restrict automatic upgrade guidance. Require security review before changing the pinned package or extension version. 7. Prefer a controlled internal artifact registry or trusted release mirror for privileged browser-control components. 8. Document a reproducible process for verifying that the Python package and browser extension correspond to the same audited release. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:69
Finding: Predictable Operator Credential and Command-Line Secret Exposure
Content: View full analysis
/tmp/browser-bridge-server.log 2>&1 & echo $! >/tmp/browser-bridge-server.pid ``` ``` The same reusable operator credential is then placed directly on the command line: ```markdown All examples use: - `instance_id=local-instance` - `client_id=chrome-main` - operator token `Str0ng!Operator#42` - operator websocket `ws://127.0.0.1:8765/ws/operator` You can pass the operator token either with `--token` or by exporting `BRIDGE_OPERATOR_TOKEN`. The examples below use `--token` explicitly for clarity. List connected browser clients: ```bash browser-bridge --server-ws-url ws://127.0.0.1:8765/ws/operator --token 'Str0ng!Operator#42' list-clients ``` ``` ### Technical Analysis Although the document initially recommends generating random tokens, its operational startup and CLI examples use fixed values. Users who copy the examples may deploy a predictable operator token known to anyone who can read the public documentation. The operator token protects a privileged interface that can observe page content and issue browser actions. Supplying the token through `--token` also places it in the process argument vector and commonly leaves it in shell history. Depending on operating-system process visibility and account separation, other local processes or users may be able to recover it. The default operator endpoint is bound to loopback, which limits direct network exposure in the documented configuration. Nevertheless, any malicious process with suitable local access can attempt authentication. The risk increases substantially i ...[truncated 1820 chars]
Remediation: View remediation
' ``` 2. Use the existing `secrets.token_urlsafe(32)` generation procedure consistently in every startup and CLI example. 3. Make the server reject known examples, placeholders, default values, and insufficiently random tokens. 4. Avoid passing credentials through `--token`. Read the operator token from a protected environment variable, restricted file descriptor, or operating-system secret store. 5. If an environment variable is used, ensure it is not printed in logs, diagnostics, or command traces and remove it when no longer required. 6. Keep the service bound to `127.0.0.1` by default and fail closed if a non-loopback binding is requested without explicit secure configuration. 7. For non-local deployments, require TLS using `wss://`, network access controls, short-lived credentials, and token rotation. 8. Generate separate tokens for each deployment and avoid sharing tokens across users, hosts, environments, or browser clients. 9. Set restrictive permissions on server logs, PID files, configuration files, and any secret-bearing files. 10. Add rate limiting and authentication-failure logging to reduce token-guessing attempts and support detection. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill enables observation of DOM data, HTML snapshots, and active control of the user's live Chrome tab, but the introductory usage guidance does not clearly warn that this can expose sensitive browsing content, session state, or page-entered data. In this context, omission of an explicit privacy warning is dangerous because the capability is inherently high-sensitivity and users may not realize the scope of data collection and control being delegated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The examples show concrete token values such as 'change-me-strong-token' and 'Str0ng!Operator#42', and later reuse the operator token in command examples. Even though some text recommends generating strong tokens, including reusable-looking secrets in copy-pastable commands creates a realistic risk that operators will deploy predictable credentials, allowing unauthorized control of the browser bridge if the service becomes reachable by another local user or a non-local network path.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to retrieve full HTML snapshots from the user's live browser context, which can include authentication state, personal data, hidden form fields, page text, and other sensitive content. Because this skill is designed for real-tab control rather than a sandboxed test browser, the context makes disclosure significantly more dangerous: the agent may access whatever the user is currently signed into.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.