Browser Agent Bridge CLI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:23 AM UTC
• Version: 1.0.4

Overview

The skill is purpose-aligned but gives an agent broad read and control access to a live Chrome session with weak setup safeguards.

Review before installing. Only use this with tabs you intend the agent to inspect or control, generate fresh random tokens instead of copying the examples, keep the bridge bound to localhost, stop the server and disable the extension when finished, and prefer pinned, verified releases of the CLI and extension.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:53
• Finding: Unpinned Third-Party CLI and Browser Extension Supply Chain<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:53-59` and `SKILL.md:85-90` **Vulnerability Type**: Unpinned third-party dependencies from mutable external sources **Risk Level**: Medium ### Vulnerable Code ```markdown ## Install the CLI ```bash python3 -m pip install --user pipx python3 -m pipx ensurepath pipx install browser-agent-bridge ``` ``` The browser extension is also obtained from a mutable repository without a pinned commit or integrity verification: ```markdown ## Connect the Chrome extension (tell your human to do this) 1. Open `chrome://extensions`. 2. Enable `Developer mode`. 3. Click `Load unpacked`. 4. Select the extension provided by this project from https://github.com/NmadeleiDev/browser_agent_bridge (`extension/` folder). ``` ### Technical Analysis The instructions install `browser-agent-bridge` without specifying an audited version, package hash, or signature. They also direct the user to load an unpacked Chrome extension from a GitHub repository without pinning a commit or verifying the downloaded files. Both external components therefore remain mutable after this skill has been reviewed. If the PyPI package, publisher account, GitHub repository, or distribution path is compromised, subsequently installed content can differ from the content originally assessed. This is especially sensitive because the installed components form a browser-control channel. According to the documented functionality, that channel can retrieve page HTML and DOM information and perform navigation, clicks, typing, scrolling, and key presses. The Python package is also executed under the installing user's local account. ### Attack Path 1. An attacker compromises the upstream PyPI publisher, GitHub repository, maintainer credentials, or release process. 2. The attacker publishes a modified package version or changes the extension source in the repository. 3. A user follows the documented unpinned installation instructions or runs `pipx up ...[truncated 1119 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `browser-agent-bridge` to a specifically reviewed version: ```bash pipx install 'browser-agent-bridge==<audited-version>' ``` 2. Publish and verify cryptographic hashes or signed release artifacts before installation. 3. Pin the extension to an audited Git commit or signed release archive rather than instructing users to load the repository's current state. 4. Document the expected extension file hashes and require verification before loading it into Chrome. 5. Review and document the extension manifest, host permissions, and content-script scope. Grant only the minimum permissions necessary. 6. Remove or restrict automatic upgrade guidance. Require security review before changing the pinned package or extension version. 7. Prefer a controlled internal artifact registry or trusted release mirror for privileged browser-control components. 8. Document a reproducible process for verifying that the Python package and browser extension correspond to the same audited release. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:69
• Finding: Predictable Operator Credential and Command-Line Secret Exposure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:69-77` and `SKILL.md:102-113` **Vulnerability Type**: Hard-coded example credential and insecure secret handling **Risk Level**: Medium ### Vulnerable Code ```markdown Use static auth for straightforward local setup: ```bash export BRIDGE_AUTH_MODE=static export BRIDGE_SHARED_TOKEN='change-me-strong-token' export BRIDGE_OPERATOR_TOKEN='Str0ng!Operator#42' browser-bridge-server >/tmp/browser-bridge-server.log 2>&1 & echo $! >/tmp/browser-bridge-server.pid ``` ``` The same reusable operator credential is then placed directly on the command line: ```markdown All examples use: - `instance_id=local-instance` - `client_id=chrome-main` - operator token `Str0ng!Operator#42` - operator websocket `ws://127.0.0.1:8765/ws/operator` You can pass the operator token either with `--token` or by exporting `BRIDGE_OPERATOR_TOKEN`. The examples below use `--token` explicitly for clarity. List connected browser clients: ```bash browser-bridge --server-ws-url ws://127.0.0.1:8765/ws/operator --token 'Str0ng!Operator#42' list-clients ``` ``` ### Technical Analysis Although the document initially recommends generating random tokens, its operational startup and CLI examples use fixed values. Users who copy the examples may deploy a predictable operator token known to anyone who can read the public documentation. The operator token protects a privileged interface that can observe page content and issue browser actions. Supplying the token through `--token` also places it in the process argument vector and commonly leaves it in shell history. Depending on operating-system process visibility and account separation, other local processes or users may be able to recover it. The default operator endpoint is bound to loopback, which limits direct network exposure in the documented configuration. Nevertheless, any malicious process with suitable local access can attempt authentication. The risk increases substantially i ...[truncated 1820 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all reusable credential values from operational examples. Use explicit placeholders such as: ```bash export BRIDGE_OPERATOR_TOKEN='<randomly-generated-operator-token>' ``` 2. Use the existing `secrets.token_urlsafe(32)` generation procedure consistently in every startup and CLI example. 3. Make the server reject known examples, placeholders, default values, and insufficiently random tokens. 4. Avoid passing credentials through `--token`. Read the operator token from a protected environment variable, restricted file descriptor, or operating-system secret store. 5. If an environment variable is used, ensure it is not printed in logs, diagnostics, or command traces and remove it when no longer required. 6. Keep the service bound to `127.0.0.1` by default and fail closed if a non-loopback binding is requested without explicit secure configuration. 7. For non-local deployments, require TLS using `wss://`, network access controls, short-lived credentials, and token rotation. 8. Generate separate tokens for each deployment and avoid sharing tokens across users, hosts, environments, or browser clients. 9. Set restrictive permissions on server logs, PID files, configuration files, and any secret-bearing files. 10. Add rate limiting and authentication-failure logging to reduce token-guessing attempts and support detection. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill enables observation of DOM data, HTML snapshots, and active control of the user's live Chrome tab, but the introductory usage guidance does not clearly warn that this can expose sensitive browsing content, session state, or page-entered data. In this context, omission of an explicit privacy warning is dangerous because the capability is inherently high-sensitivity and users may not realize the scope of data collection and control being delegated.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The examples show concrete token values such as 'change-me-strong-token' and 'Str0ng!Operator#42', and later reuse the operator token in command examples. Even though some text recommends generating strong tokens, including reusable-looking secrets in copy-pastable commands creates a realistic risk that operators will deploy predictable credentials, allowing unauthorized control of the browser bridge if the service becomes reachable by another local user or a non-local network path.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to retrieve full HTML snapshots from the user's live browser context, which can include authentication state, personal data, hidden form fields, page text, and other sensitive content. Because this skill is designed for real-tab control rather than a sandboxed test browser, the context makes disclosure significantly more dangerous: the agent may access whatever the user is currently signed into.

Static analysis

No suspicious patterns detected.