auto-browser

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:14 AM UTC
• Version: 1.0.0

Overview

This skill is built for real-browser automation, but it grants broad local browser control and persistent setup in ways users should review carefully before installing.

Review this skill before installing. It can operate a real browser session, read page data, fill forms, and use JavaScript on pages. Only use it if you are comfortable with Chrome remote debugging, pin the MCP package version instead of using @latest, require explicit approval before starting Chrome or accessing logged-in sites, and close/clean up the debug browser after each task.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:174

Finding

Mutable Third-Party Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 174-181
Vulnerability Type: Unsafe, unpinned dependency execution
Risk Level: High

json

"playwright-cdp": {
  "command": "npx",
  "args": ["-y", "@playwright/mcp@latest", "--cdp-endpoint", "http://127.0.0.1:9222"]
}

Technical Analysis

The proposed persistent MCP configuration invokes npx with both -y and the mutable version selector @latest. This causes the package manager to accept installation automatically and execute whichever release is currently identified as the latest version.

Because the effective executable can change after the Skill has been reviewed, the configuration does not provide a reproducible or auditable dependency boundary. A compromised package maintainer account, malicious future release, or package-registry compromise could replace the expected implementation with arbitrary code.

Writing this command into ~/.cursor/mcp.json also makes the unsafe execution behavior persistent across future MCP reloads. Persistent MCP configuration modification exceeds the minimum privileges needed to carry out an individual browser-automation request and should not occur without explicit user approval.

Attack Path

1. An attacker compromises the @playwright/mcp package, its maintainer account, or the package distribution channel.
2. The attacker publishes a malicious version and causes it to become the package's latest release.
3. The user follows the Skill instructions and adds the command to ~/.cursor/mcp.json.
4. Cursor reloads the MCP configuration and invokes npx -y @playwright/mcp@latest.
5. npx downloads and executes the attacker-controlled package without an interactive installation confirmation.
6. The malicious package executes with the operating-system privileges of the Cursor user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the current user's ac ...[truncated 434 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version.
2. Use package-locking and integrity verification where supported so that the resolved artifact cannot change silently.
3. Verify and document the authoritative package name, publisher, and registry source.
4. Avoid npx -y for initial installation. Require the user to review and explicitly approve the package and version.
5. Do not modify ~/.cursor/mcp.json automatically. Display the proposed configuration and request explicit consent before writing it.
6. Restrict the MCP process using operating-system sandboxing and the minimum filesystem and network permissions needed for browser control.
7. Establish a controlled upgrade process in which new versions are reviewed before the pinned version is changed.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:32

Finding

Unauthenticated Chrome Debugging Endpoint Is Started Without Consent or Lifecycle Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-48
Vulnerability Type: Exposed local browser-control interface and unmanaged background process
Risk Level: Medium

bash

curl -s http://127.0.0.1:9222/json/version

bash

nohup /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome \
  --remote-debugging-port=9222 \
  --user-data-dir="/tmp/chrome_debug_profile" \
  > /tmp/chrome_debug.log 2>&1 &

The associated instructions direct the agent to start Chrome immediately, without asking the user, when the endpoint does not respond.

Technical Analysis

Chrome DevTools Protocol provides extensive control over the debug browser, including page inspection, navigation, JavaScript execution, screenshots, and access to browser state available within that profile. The endpoint shown here has no application-level authentication.

Although it is addressed through 127.0.0.1, any other process operating in the same local security context and capable of reaching the port may attempt to connect. The Skill does not verify that an existing listener on port 9222 belongs to the intended Chrome process. It treats any successful version response as sufficient and then directs the MCP tool to use that endpoint.

The command also starts Chrome as a detached background process using nohup, but the Skill provides no shutdown procedure, process identifier tracking, maximum lifetime, or cleanup requirements. Consequently, the browser-control interface may remain active after the requested task is complete.

The separate debug profile reduces exposure of the user's ordinary Chrome profile, but it can still accumulate sensitive data entered or generated during automated sessions. Starting this service without consent and leaving it running exceeds the minimum lifecycle privileges required for a bounded browser task.

Attack Path

1. The Skill starts Chrome in the background with remote debugging ...[truncated 1575 chars]

Remediation

View remediation

Remediation Suggestions

1. Request explicit user approval before starting a browser with remote debugging enabled.
2. Verify that an existing endpoint belongs to the expected Chrome process and current user rather than accepting any response from port 9222.
3. Allocate a non-fixed, task-specific local port where integration support permits it.
4. Keep the endpoint bound exclusively to loopback and prevent network forwarding or external exposure.
5. Continue using a dedicated profile, but create it in a securely permissioned, task-specific directory rather than a predictable shared temporary path.
6. Track the process identifier and terminate the debug browser when the requested operation is complete.
7. Add cleanup for temporary profile data and logs, subject to explicit user retention requirements.
8. Define an inactivity timeout and fail closed if endpoint identity or ownership cannot be established.
9. Avoid entering passwords or other sensitive information until the endpoint has been validated and the user has approved the operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are extremely broad and match common conversational requests like 'open browser' or 'help me click', making accidental invocation likely. Because this skill operates a real browser session with preserved login state, over-broad activation can unexpectedly expose private accounts and perform actions on live sites.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill does not prominently warn that it can extract data from a real logged-in browser session, which may include private messages, account data, and sensitive business information. Users may invoke it expecting routine browsing help, without understanding the privacy and account-access implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill omits a prominent warning that it may automatically launch a real Chrome instance with remote debugging and a persistent profile directory, without user approval. This is dangerous because it changes the user's local environment and enables deep control over a live browser session beyond what the skill description suggests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Stating that users can describe intent in natural language without clear trigger constraints makes the skill easier to invoke unintentionally. In combination with powerful browser-control capabilities, ambiguous invocation increases the chance of unreviewed access to authenticated pages or unintended state changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to run local shell commands to probe and, if needed, launch a real Chrome instance with remote debugging enabled, without asking the user. This expands the skill from browser automation into local process execution and can expose the user's active browser session, cookies, and authenticated state to automated control.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

Using nohup to launch Chrome in remote-debug mode creates a background process with session persistence beyond the immediate task. A persistent debug-enabled browser increases the window for misuse, unintended reconnection, or later access to authenticated browser state.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

• ❌ 无响应 → 直接启动，不问用户：

bash

nohup /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome \
  --remote-debugging-port=9222 \
  --user-data-dir="/tmp/chrome_debug_profile" \
  > /tmp/chrome_debug.log 2>&1 &

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Allowing arbitrary browser_evaluate JavaScript as a fallback gives the agent a stronger primitive than ordinary click/type/navigation, including the ability to read or modify DOM state in ways not visible to the user. In a real logged-in browser context, this can bypass intended UI constraints and extract sensitive page data at scale.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill's safety model says read-only actions are freely allowed, but its workflow also authorizes browser_evaluate as a fallback without equivalent guardrails. Because injected JavaScript can perform state-changing actions or hidden reads, the documented boundary is misleading and can cause unsafe automation decisions.

Content

No source excerpt is available for this finding.