Bits Browser Automation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:22 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent browser-automation integration, but it asks users to run an unpinned npm MCP server and use stored credentials or authentication flows without enough scoping or safety guidance.

Review this skill before installing. Use a dedicated, revocable Bits API key, restrict local config file permissions, avoid high-privilege accounts, and do not submit secrets, regulated data, or sensitive business data through browser automation unless you trust Bits, the target site, and the npm package version being executed. Prefer pinning `usebits-mcp` to a reviewed version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28–31 and 43–46
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

json

"command": "npx",
"args": ["-y", "usebits-mcp"],
"env": {
  "BITS_API_KEY": "bb_your_key_here"
}

The same configuration is documented for both the OpenClaw and Claude Code MCP clients.

Technical Analysis

The configuration invokes usebits-mcp through npx without specifying an exact package version, lockfile, checksum, or integrity value. Consequently, each uncached installation can resolve to whichever package release is current at execution time rather than the release that was reviewed when the skill was published. The -y option automatically accepts installation, eliminating an interactive opportunity to inspect the resolved package.

npm package lifecycle and runtime code execute locally under the MCP process user's account. The process also receives BITS_API_KEY through its environment. If the package's publisher account, release pipeline, registry entry, or transitive dependency is compromised, attacker-controlled code could execute locally and access that credential.

Attack Path

1. An attacker compromises the usebits-mcp package, one of its dependencies, its publisher account, or the applicable package-distribution path.
2. The attacker publishes a malicious release that remains resolvable under the unversioned package name.
3. A user copies the documented MCP configuration and starts or restarts the client.
4. npx -y usebits-mcp automatically downloads and executes the currently resolved release without version or integrity verification.
5. Malicious package installation or runtime code executes with the permissions of the local user running the MCP client.
6. The code reads BITS_API_KEY from the process environment and may transmit it externally, access local user data, or perform other operations allo ...[truncated 555 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin usebits-mcp to a reviewed, exact version rather than relying on the latest resolvable release.
2. Install the dependency through a committed lockfile and enforce npm integrity metadata during installation.
3. Prefer a controlled installation step over automatic runtime installation. Remove -y where practical so unexpected package resolution is not silently accepted.
4. Document the expected package publisher, source repository, version, and verification procedure.
5. Run the MCP server in a sandbox or dedicated low-privilege account with restricted filesystem and network access.
6. Use a narrowly scoped, revocable API key and rotate it immediately if dependency compromise is suspected.
7. Incorporate dependency monitoring and review newly published versions before updating the pinned release.
8. Apply equivalent corrections to both documented configuration blocks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 73% confidence

Finding

The setup instructs users to create a long-lived API key and place it in local MCP configuration, but it does not warn about secure storage, scope limitations, rotation, or the consequences of compromise. In practice, such keys can persist across sessions and grant ongoing access to the browser automation service if the workstation or config file is exposed.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

1. Go to [app.usebits.com](https://app.usebits.com)
2. Sign in with Google
3. Navigate to **Settings → API Keys**
4. Click **Create API Key**, give it a name
5. Copy the key (starts with `bb_`) — you won't see it again

### 2. Configure MCP

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly encourages form filling and submission through remote browser automation but does not warn users that entered data may be transmitted to third-party websites and processed by the Bits service. In a browser automation context, users may submit personal, financial, or sensitive business data without realizing the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises support for OAuth, login forms, 2FA, and stored credentials without warning users about the risks of delegating authentication flows to a third-party browser automation service. This can expose session tokens, account access, and privileged workflows if users do not understand where credentials are stored, how sessions persist, or what actions the automation agent may perform after login.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

- **Navigate** — Go to URLs, handle redirects
- **Read pages** — Extract text, get page layouts, take screenshots
- **Interact** — Click elements, fill inputs, press keys
- **Handle auth** — OAuth popups, login forms, 2FA (with stored credentials)
- **Multi-window** — Switch between tabs/popups
- **Structured output** — Return data in specific JSON schemas

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

## Links

- Web app: [app.usebits.com](https://app.usebits.com)
- API docs: [api.usebits.com/openapi.json](https://api.usebits.com/openapi.json)

Static analysis

No suspicious patterns detected.