browser-testing-toolkit

• Outcome: Review
• Latest audit: Aug 3, 2026 · 1:12 AM UTC
• Version: 1.1.0

Overview

The skill is a coherent browser testing toolkit, but it includes under-scoped automation that can run raw shell server commands and automatically accept consent prompts.

Install only if you need browser automation and E2E testing helpers, and treat it as capable of clicking through pages and running local commands. Do not let page content, test data, or untrusted agent output populate --server commands, avoid authenticated or production sites unless explicitly intended, and disable or review smart-click auto dismissal before testing pages with cookie or privacy consent prompts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"Starting server {i+1}/{len(servers)}: {server['cmd']}")

            # Use shell=True to support commands with cd and &&
            process = subprocess.Popen(
                server['cmd'],
                shell=True,
                stdout=subprocess.PIPE,

• Confidence: 98% confidence
• Finding: process = subprocess.Popen( server['cmd'], shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly instructs use of shell-capable tools and commands such as `playwright-cli`, `python`, and server-launch wrappers, but the metadata shown does not declare corresponding permissions. This creates a governance and sandboxing gap: an agent may invoke command execution capabilities without users or platform policy having explicit visibility into that power.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger keywords are very broad terms like `click`, `fill`, `simple`, `debug`, `network`, and `test`, which can match many unrelated user requests. Overbroad activation can cause the agent to invoke browser automation or debugging workflows in contexts where the user did not intend to use this skill, increasing the chance of unintended browsing, command execution, or interaction with sensitive pages.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The automatic branch-selection logic is described as routing from user intent directly into L1/L2/L3 behaviors, but it does not clearly define when the skill should abstain, ask for confirmation, or refuse higher-risk actions. This ambiguity can lead to unsafe escalation from benign phrasing into shell execution, DevTools inspection, or automated testing against real environments without clear user consent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code enables automatic dismissal of blockers and, in this toolkit, that includes clicking consent-style UI without any explicit user confirmation. Even though the feature is intended to improve test reliability, automatically accepting cookie or privacy prompts can silently alter privacy preferences and produce actions the human operator did not authorize.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: This function actively searches for consent-related containers and clicks buttons whose text matches 'accept', 'agree', 'allow', 'ok', or similar phrases, including a page-wide fallback search. That behavior can change privacy settings, grant tracking/marketing consent, or authorize other site actions under the guise of dismissing UI, especially because text-based heuristics are broad and may match non-cookie dialogs.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script intentionally uses shell-based execution for server commands but provides no guardrails or warning that the input is interpreted by a shell. In a browser automation toolkit, users may compose commands dynamically from test config or agent input, making accidental or attacker-influenced command injection more likely.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

print(f"Starting server {i+1}/{len(servers)}: {server['cmd']}")

            # Use shell=True to support commands with cd and &&
            process = subprocess.Popen(
                server['cmd'],
                shell=True,
                stdout=subprocess.PIPE,

• Confidence: 98% confidence
• Finding: subprocess.Popen( server['cmd'], shell=True

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

print(f"Starting server {i+1}/{len(servers)}: {server['cmd']}")

            # Use shell=True to support commands with cd and &&
            process = subprocess.Popen(
                server['cmd'],
                shell=True,
                stdout=subprocess.PIPE,

• Confidence: 98% confidence
• Finding: Popen( server['cmd'], shell=True

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.