Browser Opener Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:54 AM UTC
• Version: 1.0.0

Overview

The browser-opening functionality matches the stated purpose, but the README tells users to install unnecessary standard-library module names from PyPI, creating avoidable supply-chain risk.

Review before installing. Do not run the README's `pip install webbrowser subprocess argparse` command; the skill uses only Python standard-library modules. If you use it, run it in a normal user context and only open URLs you trust, because it will launch local browser tabs/windows and make network connections.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:17

Finding

Unnecessary Installation of Standard-Library Module Names from PyPI

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 17–21
Vulnerability Type: Dependency confusion and unsafe third-party package installation
Risk Level: Medium

Vulnerable Code

markdown

### 1. 安装依赖

```bash
pip install webbrowser subprocess argparse

text

### Technical Analysis

The installation command instructs users to install `webbrowser`, `subprocess`, and `argparse` from the Python Package Index. These modules are already part of Python's standard library and are imported directly by the project; no external installation is required.

Running this command causes `pip` to resolve third-party distributions that happen to use standard-library module names. Those distributions are unrelated to the trusted modules bundled with Python and are not included in or reviewed as part of this project. Depending on package availability, version, build configuration, and package contents, installation may execute package-controlled build hooks or place untrusted code in the user's Python environment.

This creates an avoidable supply-chain exposure consistent with dependency confusion or package-name spoofing. The audit did not establish that any specific package currently resolved by this command is malicious; the vulnerability is the unsafe instruction to retrieve unnecessary, unpinned third-party code.

### Attack Path

1. A user follows the installation instructions in `README.md`.
2. The user runs `pip install webbrowser subprocess argparse`.
3. `pip` queries configured package indexes for distributions with those names.
4. Third-party packages and their transitive build dependencies may be downloaded without version or hash verification.
5. Package-controlled installation or build logic may execute with the privileges of the user running `pip`.
6. A malicious or compromised distribution could alter the Python environment, access data available to that user, or execute additional payloads.

### Impact Assessment

Successful exploitat
...[truncated 630 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the pip install webbrowser subprocess argparse command entirely.
2. State explicitly that the project has no external Python dependencies because webbrowser, subprocess, and argparse are provided by the Python standard library.
3. Replace the affected section with guidance such as:

markdown

### Dependencies

No third-party Python packages are required. This project uses only Python standard-library modules.

4. If external dependencies are introduced later:
   • Declare only reviewed packages in a dedicated dependency manifest.
   • Pin exact versions.
   • Use package hashes where supported.
   • Generate and review a lock file.
   • Scan direct and transitive dependencies for known vulnerabilities.
   • Install packages in an isolated virtual environment without administrative privileges.
5. Add documentation or CI checks that reject standard-library module names in dependency manifests and installation commands.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. The natural-language documentation forces a specific language for all instructions and descriptions, and there is no opt-in, alternative language, or stated reason that the skill is intended only for a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/open_browser.py (reported line 57)May include surrounding context.

python

for name in possible_names:
            # Check if the browser is available in PATH
            try:
                result = subprocess.run(['where' if self.system == 'windows' else 'which', name], 
                                      capture_output=True, text=True)
                if result.returncode == 0:
                    return name

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/open_browser.py (reported line 195)May include surrounding context.

python

cmd.append(url)
            
            # Execute command
            result = subprocess.run(cmd, capture_output=True, text=True)
            
            if result.returncode == 0:
                return True

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This is a markdown file, so SQP-2 applies to omissions in user-facing warnings. The usage section shows commands that launch a browser to arbitrary URLs, including incognito/headless modes, but does not warn users that opening untrusted URLs may expose their IP/session context to remote sites or cause unexpected browser activity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This code performs visible external actions by opening multiple websites, which can affect the user's browser session and system state. While there are print statements announcing the action, there is no confirmation prompt or explicit warning that running the examples will automatically launch batches of URLs in different browsers.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The comment and printed banner say the example opens sites in Firefox private mode, but open_multiple_urls is defined with only urls, browser_name, and delay parameters. The call at L54 passes incognito=True, so this example does not implement the documented behavior and would instead raise a runtime argument error.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.