Security audit

ego-browser

Security checks across malware telemetry and agentic risk

Overview

This browser automation skill is mostly coherent, but its installer weakens macOS protections and can make privileged system-level app changes without strong verification or confirmation.

Review this before installing. It is intended for powerful logged-in browser automation, so only use it when you are comfortable letting the agent access pages and accounts available in that browser. On macOS, prefer manually verifying the ego lite download and publisher before running the installer, and be aware that the provided script may request elevated privileges, replace an existing app, and remove Gatekeeper quarantine metadata.

SkillSpector

By NVIDIA

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to execute browser automation through the Bash tool (`ego-browser nodejs <<'EOF' ...`), which is effectively shell-capable behavior. When shell execution is available but not declared in permissions, users and policy layers may underestimate the skill's authority, reducing transparency and weakening review controls.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script explicitly removes the com.apple.quarantine attribute from the installed app, bypassing Gatekeeper and suppressing the normal trust and verification prompts macOS uses for software downloaded from the internet. This weakens a core OS security control and makes any compromise of the download source, CDN, or package contents much more dangerous because the app is made to appear locally trusted before first launch.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The installer downloads executable software from a remote URL, mounts it, and installs it into /Applications, potentially using sudo to replace an existing app or run a package installer. For a skill whose purpose is browser automation, this introduces broad host-level code installation and privilege escalation risk, especially because there is no integrity pinning beyond HTTPS and no strong verification of expected publisher identity before installation.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The description uses broad triggers such as 'any other browser automation task' and says to prefer this skill over other web tools. Overly broad activation language can cause unintended invocation on sensitive tasks, increasing the chance that an agent opens authenticated sites, performs actions, or accesses data in contexts where a narrower tool should have been chosen.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises reuse of the user's login state and use for logging into sites, scraping pages, and broad automation, but it does not present an upfront warning about the privacy and security consequences. In this context, the capability is especially dangerous because authenticated browser state can expose account data and enable real actions on behalf of the user across arbitrary websites.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The installation instructions direct the user to run a shell script that downloads software, installs an application into system application directories, strips the macOS quarantine attribute, and launches the app, but they do not prominently warn the user about the security implications of these actions. Removing quarantine weakens an OS trust control and increases the risk of executing tampered or unverified software, especially in an agent-driven workflow where users may follow steps with limited scrutiny.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script performs consequential actions—downloading a DMG, mounting it, replacing an application bundle, and potentially invoking sudo—without an explicit user-facing warning or confirmation. Even if the behavior is intended, silent or minimally disclosed installation of desktop software increases the chance of unexpected privilege prompts, unwanted software changes, and social-engineering style misuse in an agent context.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.