webchat-extension

• Outcome: Review
• Latest audit: Aug 7, 2026 · 7:11 AM UTC
• Version: 0.1.5

Overview

This is a real browser AI chat skill, but it needs Review because it automatically collects clipboard and webpage context, stores it, and exposes a permissive local backend tied to CodeBuddy credentials.

Install only if you are comfortable with an extension that can read selected webpage text and your system clipboard on arbitrary pages, store that context locally, and send it with page metadata and chat history to a local backend that may call CodeBuddy AI using your local login or API key. Prefer using it only on non-sensitive pages, restrict the backend to localhost with a strict allowed origin, disable automatic clipboard capture/persistence if possible, and skip or remove the webchat:// protocol handler unless you need one-click backend launch.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill describes network access and environment-variable handling for a local Express backend and AI transport, but does not declare corresponding permissions or trust boundaries. This creates a transparency and review gap: operators may invoke or deploy the skill without realizing it will read local configuration and send data to localhost/AI services.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The /api/auth handler inspects the local ~/.codebuddy/local_storage directory to infer whether the user is logged in. Even though it does not read secret values directly, it accesses sensitive credential-state information unrelated to simple web chat and exposes that state over an unauthenticated HTTP API, which can reveal local authentication status to any origin when CORS is permissive.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The panel reads system clipboard contents, including asynchronously and via execCommand fallback, which exceeds a user expectation of only using explicitly selected page text. Clipboard data often contains passwords, tokens, personal messages, or unrelated sensitive content, and this file later persists and transmits that data to the backend.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The comments claim only short read-only previews are shown, but the implementation places full context text into the title attribute, exposing the entire snippet on hover. This undermines the stated privacy boundary and can reveal sensitive captured content to anyone viewing the screen or inspecting the DOM.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger text includes broad natural-language phrases such as asking for a browser chat tool or sending webpage content to AI, which could match routine assistance requests unintentionally. Over-broad activation can cause the agent to deploy or recommend a skill that captures webpage selections and clipboard content in contexts where the user did not explicitly ask for that data flow.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The '什么时候用' section is still broad enough to match generic browsing-help or summarization requests, not just explicit extension deployment requests. In this skill's context, accidental invocation is more dangerous because the described system collects arbitrary webpage selections, copied text, and ongoing chat context for transmission to the backend and model.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The usage section tells users to add selected text and notes that the system may also collect clipboard text, but it does not provide an explicit privacy warning that this content is sent to the local backend and then to an AI service for processing. Because selections may include sensitive information from arbitrary webpages, missing disclosure materially increases the risk of inadvertent exfiltration of personal, corporate, or regulated data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The backend exposes credential/authentication state through /api/auth without any access control or warning to the user. Because the server enables configurable cross-origin access and by default allows '*', any local web page or extension capable of reaching the service may learn whether CodeBuddy credentials or login state exist on the machine.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code explicitly embeds page title, page URL, and selected page content into the system prompt sent to the model. That means potentially sensitive browsing data is transmitted to an external AI service, and this file shows no technical safeguard such as redaction, allowlisting, consent gating, or minimization before transmission.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This code gathers selected text from all frames in the active tab via executeScript and returns it to the extension without any visible disclosure or frame-level restriction in this component. Because selection text can contain sensitive user data from embedded documents or reading apps, broad collection across iframes increases the risk of over-collection and unintended exposure to the AI backend.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The content script can invoke a custom protocol handler via a hidden iframe to launch a local application or backend without any visible prompt, disclosure, or confirmation logic in this file. Because this script runs on arbitrary webpages and accepts a generic postMessage command, it increases the risk of surprising local-app launch behavior and weakens user control, even if the browser may still apply some protocol-handling safeguards.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The file is designed to run on arbitrary webpages, and the comments indicate iframe/all-frame injection behavior intended for broad cross-site operation. In this context, broad content-script exposure is risky because the script handles page messages, stores browsing context, injects UI into untrusted pages, and can trigger sensitive actions, expanding the attack surface across every matched site.

Missing User Warnings

High

• Confidence: 88% confidence
• Finding: The manifest description explicitly states that the extension reads webpage selections and the system clipboard and automatically includes them in AI conversation context, but there is no visible privacy warning or consent flow in this file. In the context of a browser extension running on all URLs, this creates a meaningful risk of collecting sensitive page and clipboard contents without users fully understanding the scope of access.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: On send, the code automatically reads clipboard content, stores it in persistent context, and includes context/history/page metadata in the backend request path without a clear just-in-time warning. This can silently exfiltrate sensitive clipboard data to a local service that may forward it onward, violating user expectations and privacy boundaries.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The 'add selected text' flow can persist selected page text and clipboard content into chrome.storage without prominently warning the user that the data will be retained across refreshes. Sensitive information from web pages or clipboard history may therefore be stored longer than intended and later reused or transmitted.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: This code path sends aggregated context, message history, page title, and page URL to the backend service without an explicit disclosure or confirmation immediately before transmission. Because the context may include clipboard-derived or sensitive page text, the extension can leak more data than the user reasonably expects from a highlight-chat workflow.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly documents capture of selected text and clipboard content, plus persistent storage of context and chat state in browser storage, but does not pair these features with a prominent privacy warning, consent flow, retention description, or guidance about sensitive data. In this skill's context, the extension operates on arbitrary webpages and may collect confidential material from documents, readers, or enterprise apps, making accidental over-collection and local retention materially risky even if the behavior is intended.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"postinstall": "node patch-sdk.mjs"
  },
  "dependencies": {
    "@tencent-ai/agent-sdk": "^0.3.43",
    "cors": "^2.8.5",
    "express": "^4.18.2",
    "dotenv": "^16.4.5"

• Confidence: 82% confidence
• Finding: Using a caret range for @tencent-ai/agent-sdk allows newer minor/patch releases to be installed automatically, which can introduce unreviewed code changes or supply-chain regressions. This package also runs alongside a postinstall workflow in the project, making dependency integrity more security-relevant for an AI-enabled backend that processes webpage content.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "@tencent-ai/agent-sdk": "^0.3.43",
    "cors": "^2.8.5",
    "express": "^4.18.2",
    "dotenv": "^16.4.5"
  }

• Confidence: 74% confidence
• Finding: Using a caret range for cors permits automatic drift to newer releases without explicit review. While the direct risk is lower for a widely used library, it still increases supply-chain uncertainty and can unexpectedly change security-relevant behavior in the backend.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "@tencent-ai/agent-sdk": "^0.3.43",
    "cors": "^2.8.5",
    "express": "^4.18.2",
    "dotenv": "^16.4.5"
  }
}

• Confidence: 91% confidence
• Finding: The express dependency is both unpinned and flagged separately as having known advisories, so allowing version drift without strict control increases supply-chain and patch-management risk. Because this is a local Express backend serving browser-extension traffic and SSE responses, insecure or unexpected framework behavior could affect users interacting with arbitrary webpages.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@tencent-ai/agent-sdk": "^0.3.43",
    "cors": "^2.8.5",
    "express": "^4.18.2",
    "dotenv": "^16.4.5"
  }
}

• Confidence: 73% confidence
• Finding: Using a caret range for dotenv is a supply-chain hygiene issue because builds may resolve to different code over time without review. The direct exploitability is limited from this file alone, but reproducibility and dependency trust are weakened.

Known Vulnerable Dependency: express==4.18.2 — 2 advisory(ies): CVE-2024-43796 (express vulnerable to XSS via response.redirect()); CVE-2024-29041 (Express.js Open Redirect in malformed URLs)

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: Express 4.18.2 has known advisories including XSS via response.redirect() and an open redirect issue in malformed URLs. In the context of a browser-extension backend that may handle user-controlled page context and navigation-related parameters, these flaws can become more dangerous if redirect behavior is exposed by server routes.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.install_untrusted_source

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: assets/backend/launcher.mjs:61

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: assets/backend/server.js:135

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/deploy.mjs:159

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/register-protocol.cjs:56

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: assets/extension/manifest.json:23