Chrome Devtools

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:38 PM UTC
• Version: 0.1.1

Overview

This skill does what it claims, but it runs a mutable third-party package and disables Chrome sandbox protections without clear disclosure.

Install only if you are comfortable with runtime npm package execution and a less isolated Chrome process. Prefer a pinned, reviewed chrome-devtools-mcp version, avoid sensitive browser profiles, and run the browser/MCP server in a restricted account or container before using it on untrusted sites.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: skill.json:4

Finding

Automatic Execution of an Unpinned Third-Party Package

Content

View full analysis

Vulnerability Details

File Location: skill.json, lines 4-7
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

json

"command": "npx",
"args": [
  "-y",
  "chrome-devtools-mcp@latest",

Technical Analysis

The skill invokes npx with the -y option to retrieve and execute chrome-devtools-mcp@latest without interactive confirmation. The mutable latest tag does not identify the exact package version that was audited. Consequently, the code executed during future invocations can change without any modification to this repository.

Installation and package lifecycle behavior may execute with the permissions of the user running the Agent. If the upstream package, its publishing account, registry distribution path, or a transitive dependency is compromised, an attacker could deliver arbitrary JavaScript through a future release.

This creates a supply-chain trust boundary outside the reviewed project and prevents reproducible deployment or verification against a known artifact.

Attack Path

1. An attacker compromises the package publisher, registry account, release process, or an included dependency.
2. The attacker publishes a malicious release and causes the latest tag to resolve to it.
3. The skill is activated on a target system.
4. npx -y retrieves the current package without requesting confirmation.
5. Package lifecycle or runtime code executes with the Agent user's permissions.
6. The malicious package can access resources available to that user and process, potentially including browser data exposed through the persistent Chrome profile.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the account running the Agent. The potential scope includes readable and writable local files, environment variables, accessible credentials, network resources, and browser-profile data available to the MCP process.

The repository itself contai ...[truncated 153 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace chrome-devtools-mcp@latest with an exact, reviewed version such as chrome-devtools-mcp@X.Y.Z.
2. Lock and verify the package integrity hash through a lockfile or equivalent deployment control.
3. Use a trusted registry and apply registry allowlisting where supported.
4. Remove unattended -y installation where practical so unexpected retrieval requires explicit approval.
5. Preinstall the approved dependency in a controlled build process rather than downloading executable code when the skill runs.
6. Review package updates and transitive dependency changes before changing the pinned version.
7. Run the MCP server under a dedicated, least-privileged account with restricted filesystem, secret, and network access.

T09 · Insecure Skill Coding Practices

Error

• Location: skill.json:8

Finding

Chrome Process Sandbox Explicitly Disabled

Content

View full analysis

Vulnerability Details

File Location: skill.json, lines 8-9
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

json

"--chrome-arg=--no-sandbox",
"--chrome-arg=--disable-setuid-sandbox"

Technical Analysis

The configuration passes both --no-sandbox and --disable-setuid-sandbox to Chrome. These options remove browser process-isolation protections intended to constrain compromised renderers and other untrusted browser components.

This skill is designed to navigate and interact with web content, which may be attacker-controlled. Disabling the sandbox increases the consequences of a browser vulnerability because malicious web content that obtains code execution in a renderer may encounter fewer barriers to affecting the host environment.

The reduced security posture is configured in skill.json but is not disclosed in SKILL.md. Browser automation alone does not establish a general requirement to disable these controls.

Attack Path

1. The skill launches Chrome with both sandbox protections disabled.
2. The Agent navigates to an attacker-controlled or compromised website during debugging or automation.
3. The page triggers a compatible Chrome or renderer vulnerability.
4. The vulnerability obtains code execution in a browser process.
5. Because the configured sandbox boundary is disabled, the exploit has a more direct path to resources available to the Chrome process and launching user.
6. The attacker may then access or modify host data within that user's permissions.

Impact Assessment

The flags do not independently grant elevated operating-system privileges, and exploitation still requires a suitable browser vulnerability or compromised browser component. However, they remove a major defense-in-depth boundary.

A successful exploit could operate with the privileges of the account launching Chrome. Its potential scope includes the persistent Chrome profile, session informa ...[truncated 217 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both --no-sandbox and --disable-setuid-sandbox.
2. Run Chrome as a non-root, dedicated service account with its supported sandbox enabled.
3. Confirm that the deployment environment provides the kernel features and permissions required by Chrome's sandbox rather than bypassing them.
4. If sandbox disabling is unavoidable in a constrained environment, isolate the entire browser and MCP server in a hardened container or virtual machine.
5. In that isolation boundary, drop unnecessary Linux capabilities, enable no-new-privileges, use a read-only root filesystem, and expose only narrowly scoped writable mounts.
6. Do not mount host credentials, browser profiles containing sensitive sessions, SSH keys, cloud tokens, or unrelated project directories.
7. Restrict outbound and internal network access to destinations required for the task.
8. Keep Chrome patched and terminate or reset the browser environment after processing untrusted content.
9. Document any remaining sandbox limitation prominently in SKILL.md so operators can make an informed deployment decision.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to use npx chrome-devtools-mcp@latest --help, which executes an unpinned package version from the registry at runtime. This creates a supply-chain risk: a malicious or compromised future release could be pulled automatically and then run in the user's environment with the permissions of the agent or host process.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.