browser Devtools Inspector

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:58 AM UTC
• Version: 1.0.0

Overview

This is a legitimate browser-debugging skill, but it needs review because it inspects arbitrary sites with an unsandboxed browser and can expose sensitive console and network data without safeguards.

Install only if you are comfortable running browser-inspection scripts yourself. Prefer local or staging targets, avoid raw production captures unless authorized, redact headers/tokens/cookies/PII before sharing output, and run the scripts in an isolated container or VM with Chromium sandboxing enabled where possible.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/capture_console.js:15
• Finding: Chromium Sandbox Disabled for Untrusted Web Content## Vulnerability Details **File Location**: `scripts/capture_console.js:15-18`, `scripts/capture_network.js:14-17`, `scripts/analyze_performance.js:14-17`, `scripts/check_cors.js:14-17` **Vulnerability Type**: Unsafe browser isolation configuration **Risk Level**: High ### Vulnerable Code The following browser launch configuration appears in all four scripts: ```js browser = await puppeteer.launch({ headless: true, args: ['--no-sandbox', '--disable-setuid-sandbox'] }); ``` ### Technical Analysis Both Chromium sandbox mechanisms are explicitly disabled. The scripts subsequently navigate to a URL supplied by the caller and process potentially hostile web content. Chromium's sandbox is a defense-in-depth boundary intended to isolate renderer processes from the host system. Disabling it substantially increases the consequences of a browser or renderer vulnerability. This configuration is not inherently malicious, but it is an unsafe default for a tool whose intended function includes visiting arbitrary development and production websites. Headless mode does not provide an equivalent security boundary. ### Attack Path 1. An attacker convinces a user or Agent to inspect an attacker-controlled URL. 2. One of the inspection scripts launches Chromium with `--no-sandbox` and `--disable-setuid-sandbox`. 3. Chromium loads and executes the attacker's web content. 4. The malicious page exploits a browser vulnerability. 5. Because the normal Chromium sandbox is disabled, the exploit encounters fewer isolation boundaries when attempting to access the host environment. Successful exploitation depends on the presence of a suitable Chromium vulnerability; the unsafe configuration does not by itself provide direct code execution. ### Impact Assessment A successful browser exploit could execute code with the operating-system privileges of the Node.js process. Depending on the execution environment, this may expose readable ...[truncated 198 chars]
• Remediation: ## Remediation Suggestions - Remove `--no-sandbox` and `--disable-setuid-sandbox` and run Chromium with its supported sandbox enabled. - Run the scripts as a dedicated, unprivileged operating-system user. - If the hosting environment cannot support the Chromium sandbox, execute the browser inside a disposable container or virtual machine with: - A read-only root filesystem. - No sensitive host mounts. - No inherited secrets or cloud credentials. - Dropped Linux capabilities. - Resource limits. - Restricted outbound and internal-network access. - Keep Chromium and Puppeteer on reviewed, supported security releases. - Clearly warn and require confirmation if an operator attempts to inspect an untrusted external site.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/capture_console.js:96
• Finding: Unrestricted Browser Navigation Enables Internal-Network Reconnaissance## Vulnerability Details **File Location**: `scripts/capture_console.js:96-111`, `scripts/capture_network.js:109-128`, `scripts/analyze_performance.js:138-149`, `scripts/check_cors.js:138-149` **Vulnerability Type**: Unvalidated destination URL and server-side request forgery exposure **Risk Level**: Medium ### Vulnerable Code `scripts/capture_console.js` accepts an arbitrary first argument and passes it to the browser workflow without validation: ```js // Parse arguments const args = process.argv.slice(2); const url = args[0]; const filter = args.find(a => a.startsWith('--filter='))?.split('=')[1] || 'all'; const verbose = args.includes('--verbose'); if (!url) { console.error('Usage: node capture_console.js <url> [--filter=error] [--verbose]'); console.error('Filters: all, log, warn, error, info'); process.exit(1); } captureConsole(url, filter, verbose); ``` `scripts/capture_network.js` follows the same pattern: ```js // Parse arguments const args = process.argv.slice(2); const url = args[0]; const filter = args.find(a => a.startsWith('--filter='))?.split('=')[1] || 'all'; const type = args.find(a => a.startsWith('--type='))?.split('=')[1] || 'all'; const pattern = args.find(a => a.startsWith('--pattern='))?.split('=')[1] || null; const verbose = args.includes('--verbose'); if (!url) { console.error('Usage: node capture_network.js <url> [--filter=failed] [--type=xhr] [--pattern=/api/*]'); console.error('Filters: all, failed, slow'); console.error('Types: all, xhr, fetch, script, stylesheet, image, font, media, document'); process.exit(1); } captureNetwork(url, filter, type, pattern, verbose); ``` `scripts/analyze_performance.js` and `scripts/check_cors.js` likewise accept and forward an unrestricted URL: ```js const args = process.argv.slice(2); const url = args[0]; const verbose = args.includes('--verbose'); if (!url) { console.error('Usa ...[truncated 2622 chars]
• Remediation: ## Remediation Suggestions - Parse input with the standard `URL` class and permit only explicitly supported schemes, normally `https:` and, where required, `http:`. - Reject URLs containing embedded usernames or passwords. - Resolve destination hostnames before navigation and reject: - IPv4 and IPv6 loopback addresses. - RFC 1918 and unique-local private addresses. - Link-local addresses. - Multicast, unspecified, and reserved ranges. - Known cloud metadata destinations. - Revalidate the resolved address immediately before connection to reduce DNS-rebinding exposure. - Inspect and validate every redirect destination rather than validating only the initial URL. - Apply outbound firewall rules so the browser process cannot access internal or metadata networks. - Use an explicit hostname allowlist when the tool is deployed as an automated Agent capability. - Require informed operator confirmation before allowing private or local destinations for legitimate debugging. - Redact sensitive response headers, URLs, query strings, and console data before emitting reports.

T08 · Insecure Dependencies

Note

• Location: scripts/package.json:4
• Finding: Mutable Puppeteer Dependency Installed Without a Lockfile## Vulnerability Details **File Location**: `scripts/package.json:4-9`; installation guidance in `SKILL.md:199-203` and `SKILL.md:225-229` **Vulnerability Type**: Non-reproducible third-party dependency installation **Risk Level**: Low ### Vulnerable Code ```json { "name": "browser-devtools-inspector-scripts", "version": "1.0.0", "description": "Browser DevTools inspection scripts using Puppeteer", "scripts": { "install-deps": "npm install" }, "dependencies": { "puppeteer": "^21.0.0" } } ``` The documentation directs users to resolve dependencies dynamically: ```bash cd scripts npm install ``` It also recommends: ```bash cd scripts npm install puppeteer ``` No package lockfile is included in the audited project structure. ### Technical Analysis The caret constraint permits npm to select different compatible Puppeteer releases over time, while the absence of a lockfile also leaves transitive dependency versions mutable. As a result, two installations from the same source tree may execute different third-party code. npm dependency installation may execute package lifecycle scripts. Puppeteer installation can also perform browser-related download and setup operations. A compromised registry account, malicious newly resolved transitive release, or dependency infrastructure compromise could therefore introduce code that was not present during review. No evidence was found that the declared `puppeteer` package name is typosquatted or currently malicious. The finding concerns supply-chain hardening and reproducibility rather than a confirmed malicious dependency. ### Attack Path 1. A user follows `SKILL.md` and runs `npm install`. 2. npm resolves the mutable Puppeteer range and transitive dependency graph using current registry metadata. 3. A compromised or unexpectedly changed package is selected. 4. Package lifecycle or runtime code executes with the privilege ...[truncated 593 chars]
• Remediation: ## Remediation Suggestions - Pin Puppeteer to an exact, reviewed version rather than using a caret range. - Generate, review, and commit `package-lock.json`. - Replace documented `npm install` usage with `npm ci` for reproducible installations. - Review dependency lifecycle scripts and transitive dependencies before upgrades. - Use automated vulnerability and integrity scanning for the lockfile. - Perform dependency updates through a controlled review process. - Where operationally possible, install dependencies in an isolated build environment without production credentials or access to sensitive internal networks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Ae1

High

• Category: analysis-evasion

Content

node scripts/capture_console.js <url> [--filter=error]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/capture_console.js <url> [--filter=error]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/capture_console.js <url> [--filter=error]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/capture_console.js <url> [--filter=error]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/capture_console.js <url> [--filter=error]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/capture_console.js <url> [--filter=error]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/capture_console.js <url> [--filter=error]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/capture_console.js <url> [--filter=error]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/capture_console.js <url> [--filter=error]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

**Possible Causes:**
1. Backend not running
2. Wrong API baseURL in .env
3. BOM encoding in PHP files
4. Redis connection failed
5. Database down

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs users to capture browser console logs, network requests, headers, and endpoint data, which commonly contain sensitive material such as authorization headers, session identifiers, personal data, internal URLs, and error traces. Because the guidance lacks any warning, redaction requirement, or restriction on production use, it increases the likelihood that sensitive telemetry will be collected, stored, or shared insecurely during debugging.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The production monitoring example normalizes collecting and exporting debugging data from a live production site to files without caution about privacy, credentials, or sensitive telemetry exposure. On real sites, captured errors and failed requests may include user-specific data, auth tokens, internal endpoints, and operational details, so encouraging export from production materially raises the risk of data leakage.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The file documents itself as a page performance analyzer, which implies it should analyze the target page using the browser instance it just launched. However, after launching a browser at L13-L16, it calls `puppeteer.newPage()` at L18 rather than `browser.newPage()`, which diverges from that intended behavior and likely prevents the documented analysis flow from working as described.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This script captures all browser network responses for an arbitrary URL and emits full request URLs and response headers as JSON. Those artifacts can contain sensitive data such as query parameters, internal endpoints, session-related metadata, API keys in URLs, or authorization/cookie-related headers, so running it against real environments can unintentionally expose confidential information to logs, terminals, or downstream storage.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The header comment presents this script as a working CORS checker, but the actual code contradicts that intent by invoking newPage on the puppeteer module rather than on the launched browser instance. That causes the advertised check flow to fail before navigation and CORS analysis can occur, so the documented behavior is not what the code actually does.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: This markdown file repeatedly tells users to run scripts like `capture_network.js`, `capture_console.js`, `check_cors.js`, and `analyze_performance.js` against target URLs, which likely collect or transmit browser/network data as part of debugging. The document provides no user-facing warning about possible privacy or data-handling impact of inspecting application traffic and console output.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This code navigates to a user-supplied URL and records response metadata for all loaded resources, including URLs, headers-derived sizes, and status codes, then prints them to output. Aside from a brief usage string and optional verbose message, there is no disclosure that running the script will initiate outbound network requests and surface detailed page/resource information.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"install-deps": "npm install"
  },
  "dependencies": {
    "puppeteer": "^21.0.0"
  },
  "engines": {
    "node": ">=14.0.0"

• Confidence: 95% confidence
• Finding: The dependency is specified with a caret range ("^21.0.0"), which allows installation of newer minor and patch releases and makes builds non-reproducible. In a security-sensitive automation skill, this increases supply-chain risk because different environments may resolve to different code, including versions with newly introduced vulnerabilities or malicious compromise.

Unverifiable Dependency: puppeteer has 1 known advisory(ies) (CVE-2019-5786 (Use-After-Free in puppeteer)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Static analysis

No suspicious patterns detected.