url2pdf-mk

• Outcome: Review
• Latest audit: May 28, 2026 · 2:32 AM UTC
• Version: 1.1.1

Overview

This skill performs webpage-to-PDF/Markdown conversion, but its default browser mode can control a real logged-in Chrome profile and ships broad CDP utilities that need review before installation.

Install only if you are comfortable with the skill controlling Chrome through CDP. Prefer --isolated or HTTP mode for public pages, reserve default mode for pages that truly require your login, run it as a normal user, and clean/stop the CDP proxy temp state after handling private content.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

else:
            print(f"   Profile:  {self._user_data_dir}（用户真实 profile，含登录态和 Cookie）")

        self._process = subprocess.Popen(args, **popen_kwargs)

        # Wait for CDP to be ready — but also watch for early process exit
        try:

• Confidence: 93% confidence
• Finding: This code launches a browser process configured for remote debugging and, in default mode, points it at the user's real browser profile. In the context of a URL-to-PDF converter, spawning a CDP-enabled browser with access to live cookies and authenticated sessions grants broad browser-control powers far beyond document conversion, increasing the blast radius if the skill or downstream logic is abused.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"   模式:     Guide（不使用 --remote-debugging-port，由用户在 inspect 页面开启）")

        try:
            subprocess.Popen(args, **popen_kwargs)
        except (OSError, FileNotFoundError) as e:
            raise RuntimeError(f"无法启动 Chrome: {e}")

• Confidence: 89% confidence
• Finding: This launches Chrome during the guide-mode flow that later enables remote debugging against the user's real profile. In this skill context, opening a controllable browser instance tied to authenticated state is more dangerous than necessary for converting pages to PDF/Markdown and can facilitate unauthorized browsing actions if misused.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# but we want the specific browser
            exe_path = detect_browser(browser)
            if exe_path:
                subprocess.Popen(
                    [exe_path, url],
                    stdout=subprocess.DEVNULL,
                    stderr=subprocess.DEVNULL,

• Confidence: 82% confidence
• Finding: This opens an internal browser debugging page in the user's installed browser as part of enabling CDP access. While not a bug in isolation, in this skill it contributes to a flow that obtains browser-control capability over the user's authenticated session, which exceeds the narrow need of rendering a webpage for export.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

exe_path = detect_browser(browser)
        if exe_path:
            try:
                subprocess.Popen(
                    [exe_path, url],
                    stdout=subprocess.DEVNULL,
                    stderr=subprocess.DEVNULL,

• Confidence: 82% confidence
• Finding: This Linux/browser-specific Popen similarly helps activate a workflow that grants CDP control over a real browser session. In the context of a document conversion skill, automatically steering the user into enabling remote debugging is broader access than necessary and raises risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

else:
        for p in ('chromium', 'chromium-browser', 'google-chrome'):
            try:
                subprocess.run([p, '--version'], capture_output=True, timeout=5)
                return True
            except Exception:
                pass

• Confidence: 88% confidence
• Finding: On Linux, the code probes browser availability by executing program names resolved through the current PATH. If an attacker can influence PATH or place a malicious executable named chromium/chromium-browser/google-chrome earlier in PATH, this check will execute attacker-controlled code. The skill context increases concern because the tool is intended to run on end-user desktops and may be launched in varied local environments.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The module exposes a direct cookie extraction method via CDP (`Network.getCookies`), which can retrieve authenticated session cookies from the user's browser profile. In this skill's context, browser mode explicitly reuses the user's Chrome profile, so this capability materially increases the risk of credential/session theft and is not necessary for URL-to-PDF/Markdown conversion.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The `evaluate` method allows arbitrary JavaScript execution in the context of whatever page is loaded, and the CLI exposes this through the `eval` subcommand. In a tool that may run against pages while reusing a logged-in browser profile, arbitrary JS can read page data, interact with authenticated sessions, trigger actions, and facilitate exfiltration well beyond the stated PDF/Markdown conversion purpose.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The launcher intentionally reuses the user's real browser profile so the skill can access cookies, login state, and extensions. For a URL-to-PDF/Markdown converter, that is excessive privilege: any compromise, prompt abuse, or logic flaw downstream can operate inside the user's authenticated web sessions rather than a sandboxed renderer.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code starts and reuses a local CDP proxy to preserve authenticated browser-control sessions across runs. Persisting a reusable control channel to a live browser session materially enlarges the attack window and enables repeated access to authenticated state beyond the one-shot conversion task described by the skill.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The CLI exposes arbitrary JavaScript execution in an attached Chrome tab via Runtime.evaluate. In this skill's context, browser mode explicitly reuses the user's Chrome profile and logged-in sessions, so JS evaluation can act with the user's authenticated web context, enabling data theft, account actions, or session abuse far beyond URL-to-PDF conversion.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The client can list, activate, create, and close arbitrary browser tabs, which exceeds the least-privilege needs of a webpage-to-PDF/Markdown converter. In combination with access to a live browser session, this capability can interfere with unrelated user activity, target other open authenticated pages, and broaden the blast radius of any misuse or higher-level prompt abuse.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The proxy exposes CDP-compatible HTTP endpoints that allow creating, activating, listing, and closing browser targets, which is broader than simple document conversion. In the context of a tool that already warns it can reuse a live Chrome profile with cookies and authenticated sessions, this materially increases the attack surface: any local process that obtains the token from the state file can drive the user's browser session and access sensitive content.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code starts and manages a long-lived background CDP proxy daemon, persisting state and a bearer token in the temp directory for later reuse. In this skill's context, that is more dangerous because the browser session may be attached to the user's real Chrome profile; a lingering daemon widens the time window in which local malware or another untrusted local user/process could connect and abuse browser debugging capabilities.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list contains broad everyday phrases such as webpage saving, link saving, offline reading, and batch scraping, which can cause unintended invocation in normal conversation. In this skill, accidental activation is more dangerous than usual because the tool can perform network fetching, write files, and potentially interact with a live browser profile.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Cookie access is implemented with no in-code user-facing disclosure or consent mechanism at the point of use. Given the skill metadata already warns that browser mode can access cookies and logged-in sessions, silently retaining a callable cookie-extraction primitive makes the overall design more dangerous because it enables sensitive data access without contextual authorization.

Static analysis

No suspicious patterns detected.