Security audit

auto-browser

Security checks for vulnerabilities and agentic risk

Overview

This skill is built for real-browser automation, but it grants broad local browser control and persistent setup in ways users should review carefully before installing.

Review this skill before installing. It can operate a real browser session, read page data, fill forms, and use JavaScript on pages. Only use it if you are comfortable with Chrome remote debugging, pin the MCP package version instead of using @latest, require explicit approval before starting Chrome or accessing logged-in sites, and close/clean up the debug browser after each task.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:174
Finding: Mutable Third-Party Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 174-181 **Vulnerability Type**: Unsafe, unpinned dependency execution **Risk Level**: High ```json "playwright-cdp": { "command": "npx", "args": ["-y", "@playwright/mcp@latest", "--cdp-endpoint", "http://127.0.0.1:9222"] } ``` ### Technical Analysis The proposed persistent MCP configuration invokes `npx` with both `-y` and the mutable version selector `@latest`. This causes the package manager to accept installation automatically and execute whichever release is currently identified as the latest version. Because the effective executable can change after the Skill has been reviewed, the configuration does not provide a reproducible or auditable dependency boundary. A compromised package maintainer account, malicious future release, or package-registry compromise could replace the expected implementation with arbitrary code. Writing this command into `~/.cursor/mcp.json` also makes the unsafe execution behavior persistent across future MCP reloads. Persistent MCP configuration modification exceeds the minimum privileges needed to carry out an individual browser-automation request and should not occur without explicit user approval. ### Attack Path 1. An attacker compromises the `@playwright/mcp` package, its maintainer account, or the package distribution channel. 2. The attacker publishes a malicious version and causes it to become the package's `latest` release. 3. The user follows the Skill instructions and adds the command to `~/.cursor/mcp.json`. 4. Cursor reloads the MCP configuration and invokes `npx -y @playwright/mcp@latest`. 5. `npx` downloads and executes the attacker-controlled package without an interactive installation confirmation. 6. The malicious package executes with the operating-system privileges of the Cursor user. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the current user's ac ...[truncated 434 chars]
Remediation: ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version. 2. Use package-locking and integrity verification where supported so that the resolved artifact cannot change silently. 3. Verify and document the authoritative package name, publisher, and registry source. 4. Avoid `npx -y` for initial installation. Require the user to review and explicitly approve the package and version. 5. Do not modify `~/.cursor/mcp.json` automatically. Display the proposed configuration and request explicit consent before writing it. 6. Restrict the MCP process using operating-system sandboxing and the minimum filesystem and network permissions needed for browser control. 7. Establish a controlled upgrade process in which new versions are reviewed before the pinned version is changed.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:32
Finding: Unauthenticated Chrome Debugging Endpoint Is Started Without Consent or Lifecycle Controls## Vulnerability Details **File Location**: `SKILL.md`, lines 32-48 **Vulnerability Type**: Exposed local browser-control interface and unmanaged background process **Risk Level**: Medium ```bash curl -s http://127.0.0.1:9222/json/version ``` ```bash nohup /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome \ --remote-debugging-port=9222 \ --user-data-dir="/tmp/chrome_debug_profile" \ > /tmp/chrome_debug.log 2>&1 & ``` The associated instructions direct the agent to start Chrome immediately, without asking the user, when the endpoint does not respond. ### Technical Analysis Chrome DevTools Protocol provides extensive control over the debug browser, including page inspection, navigation, JavaScript execution, screenshots, and access to browser state available within that profile. The endpoint shown here has no application-level authentication. Although it is addressed through `127.0.0.1`, any other process operating in the same local security context and capable of reaching the port may attempt to connect. The Skill does not verify that an existing listener on port `9222` belongs to the intended Chrome process. It treats any successful version response as sufficient and then directs the MCP tool to use that endpoint. The command also starts Chrome as a detached background process using `nohup`, but the Skill provides no shutdown procedure, process identifier tracking, maximum lifetime, or cleanup requirements. Consequently, the browser-control interface may remain active after the requested task is complete. The separate debug profile reduces exposure of the user's ordinary Chrome profile, but it can still accumulate sensitive data entered or generated during automated sessions. Starting this service without consent and leaving it running exceeds the minimum lifecycle privileges required for a bounded browser task. ### Attack Path 1. The Skill starts Chrome in the background with remote debugging ...[truncated 1575 chars]
Remediation: ## Remediation Suggestions 1. Request explicit user approval before starting a browser with remote debugging enabled. 2. Verify that an existing endpoint belongs to the expected Chrome process and current user rather than accepting any response from port `9222`. 3. Allocate a non-fixed, task-specific local port where integration support permits it. 4. Keep the endpoint bound exclusively to loopback and prevent network forwarding or external exposure. 5. Continue using a dedicated profile, but create it in a securely permissioned, task-specific directory rather than a predictable shared temporary path. 6. Track the process identifier and terminate the debug browser when the requested operation is complete. 7. Add cleanup for temporary profile data and logs, subject to explicit user retention requirements. 8. Define an inactivity timeout and fail closed if endpoint identity or ownership cannot be established. 9. Avoid entering passwords or other sensitive information until the endpoint has been validated and the user has approved the operation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger phrases are extremely broad and match common conversational requests like 'open browser' or 'help me click', making accidental invocation likely. Because this skill operates a real browser session with preserved login state, over-broad activation can unexpectedly expose private accounts and perform actions on live sites.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill does not prominently warn that it can extract data from a real logged-in browser session, which may include private messages, account data, and sensitive business information. Users may invoke it expecting routine browsing help, without understanding the privacy and account-access implications.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill omits a prominent warning that it may automatically launch a real Chrome instance with remote debugging and a persistent profile directory, without user approval. This is dangerous because it changes the user's local environment and enables deep control over a live browser session beyond what the skill description suggests.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Stating that users can describe intent in natural language without clear trigger constraints makes the skill easier to invoke unintentionally. In combination with powerful browser-control capabilities, ambiguous invocation increases the chance of unreviewed access to authenticated pages or unintended state changes.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to run local shell commands to probe and, if needed, launch a real Chrome instance with remote debugging enabled, without asking the user. This expands the skill from browser automation into local process execution and can expose the user's active browser session, cookies, and authenticated state to automated control.

Session Persistence

Medium

Category: Rogue Agent
Content: - ❌ 无响应 → 直接启动，不问用户： ```bash nohup /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome \ --remote-debugging-port=9222 \ --user-data-dir="/tmp/chrome_debug_profile" \ > /tmp/chrome_debug.log 2>&1 &
Confidence: 94% confidence
Finding: Using nohup to launch Chrome in remote-debug mode creates a background process with session persistence beyond the immediate task. A persistent debug-enabled browser increases the window for misuse, unintended reconnection, or later access to authenticated browser state.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Allowing arbitrary browser_evaluate JavaScript as a fallback gives the agent a stronger primitive than ordinary click/type/navigation, including the ability to read or modify DOM state in ways not visible to the user. In a real logged-in browser context, this can bypass intended UI constraints and extract sensitive page data at scale.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The skill's safety model says read-only actions are freely allowed, but its workflow also authorizes browser_evaluate as a fallback without equivalent guardrails. Because injected JavaScript can perform state-changing actions or hidden reads, the documented boundary is misleading and can cause unsafe automation decisions.

Static analysis

No suspicious patterns detected.