Security audit

page-agent 浏览器控制（CDP）

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed browser-automation helper, but it asks users to install an unaudited global CLI and to automate their normal logged-in browser profile by default.

Install only if you are comfortable with a global third-party CLI controlling a browser through CDP. Use a dedicated temporary browser profile instead of your daily profile, avoid sensitive accounts, verify the release archive independently where possible, and keep human confirmation for payments, posting, deletion, uploads, and account changes.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:27
Finding: Unverified GitHub Release Archive Is Installed Globally
Content: View full analysis
Remediation: View remediation
page-agent-cli-1.8.2.tgz" | sha256sum --check ``` 5. Host expected checksums through a channel independent of the release attachment. 6. Review the package manifest and lifecycle scripts before installation. 7. Use `npm install --ignore-scripts` where the package can function without lifecycle scripts. 8. Prefer a project-local, containerized, or otherwise sandboxed installation instead of a global installation. 9. Document the expected repository owner, release signer, checksum, archive contents, and package name so substitutions are easier to detect. 10. Avoid elevated installation unless strictly necessary. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:104
Finding: Browser Automation Is Directed to Use the User’s Normal Authenticated Profile
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file presents all operational guidance in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. That can violate language/locale policy by forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This CLI reference is written entirely in Chinese and does not indicate that other languages are available or that Chinese is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document is written entirely in Chinese and provides operational instructions in Chinese without any indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The natural-language description at L003 is in Chinese, and the operational guidance throughout the file is also presented only in Chinese. This effectively forces a specific language on users without opt-in or justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly recommends attaching to the user's existing Chrome/Edge profile so automation runs with the same cookies, extensions, and authenticated sessions. In a browser-driving skill, this materially increases privacy and security risk because any mistaken navigation or prompt-influenced action occurs with full access to the user's live accounts and stored data, without an explicit warning or safer default.
Content: No source excerpt is available for this finding.