Security audit

Browser Js

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for browser automation, but it gives an agent broad control of a signed-in browser without enough guardrails.

Install only if you intend to let the skill control a real browser profile. Use a dedicated non-personal browser profile, keep CDP bound to localhost, avoid using it on sensitive financial or account-management sites, confirm every file upload path yourself, and update the ws dependency before relying on it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The lockfile pins `ws` to version 8.19.0, and the supplied finding identifies known advisories affecting that exact version: uninitialized memory disclosure and memory-exhaustion denial of service. Because this skill provides browser control over a Chrome DevTools Protocol connection using WebSockets, the dependency sits directly on a network-facing and security-relevant code path, which makes exploitation more plausible and the impact more serious than in a non-networked utility.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 96% confidence
Finding: The package is reported as resolving to ws 8.19.0, which has advisories for memory disclosure and memory-exhaustion denial of service. In a skill that provides browser automation over CDP, a vulnerable WebSocket client/server component is more dangerous because it handles untrusted browser-protocol traffic and may be exposed to hostile pages, intermediaries, or local tooling, potentially causing crashes or leaking process memory.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill exposes meaningful capabilities—network access to the CDP endpoint, use of environment variables such as CDP_URL, and browser control over a signed-in session—without declaring any explicit tool scope or permission boundaries. In an agent setting, this increases the chance the skill is invoked with broader authority than users realize, enabling unintended navigation, interaction, and data access through the local browser.

Session Persistence

Medium

Category: Rogue Agent
Content: ## Alias setup (optional) ```bash mkdir -p ~/.local/bin cat > ~/.local/bin/bjs << 'WRAPPER' #!/bin/bash exec node /path/to/scripts/browser.js "$@"
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill documents direct upload of arbitrary local files into remote websites without warning that this transmits local filesystem content to third parties. Because the browser session may already be authenticated, an agent could exfiltrate sensitive documents to external services with little friction.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The documentation explicitly promotes coordinate-based clicking for captchas and cross-origin iframes, which can be used to bypass normal DOM-level restrictions and automate anti-bot or security-sensitive challenges. In the context of a browser automation skill with access to a real signed-in browser session, this materially increases abuse potential for defeating site safeguards and interacting with embedded payment, auth, or verification widgets.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill advertises lightweight browser control but does not disclose that it can execute arbitrary JavaScript in the active page via the eval command. That materially changes the trust boundary because an agent can run page-context code that reads DOM data, triggers authenticated actions, or manipulates sites beyond normal browsing expectations.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The eval command accepts arbitrary JavaScript and executes it in the currently active authenticated page context using Runtime.evaluate. In this skill context, signed-in browser sessions carry over automatically, so injected code can access sensitive page data, invoke privileged in-page actions, and exfiltrate information through network requests from the page.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The upload command reads an arbitrary local file path and submits that file into the active browser page without any explicit warning. In a signed-in browsing context, this can leak local sensitive files to remote websites through normal form submission flows, making the capability significantly more dangerous than routine form-filling.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The coordinate-based click, hover, drag, and iframe targeting features are broader than the stated purpose and are explicitly positioned for captchas, overlays, and cross-origin iframes. This increases abuse potential because it enables interaction patterns designed to bypass higher-level safety constraints and manipulate UI regions that selector-based controls cannot safely reason about.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: Allowing arbitrary JavaScript execution in the page context can modify application state, trigger authenticated actions, and access page-visible data, yet the documentation gives no warning about these side effects. While this is expected functionality for browser automation, the lack of guardrails is risky in an agent-controlled, signed-in session.

Description-Behavior Mismatch

Low

Confidence: 89% confidence
Finding: The screenshot command writes browser-captured data to an arbitrary local file path, but this local file write capability is not disclosed in the skill description. Hidden write capabilities are risky because they can persist sensitive page content to disk or overwrite files in expected writable locations without the user understanding the skill's scope.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The screenshot command silently persists page imagery to disk, which may capture sensitive tokens, account data, or private content visible in authenticated sessions. Because the skill description emphasizes browser automation and session carryover, undisclosed local persistence creates a meaningful confidentiality risk even if the primitive itself is simple.

Unpinned Dependencies

Low

Category: Supply Chain
Content: { "name": "browser-js", "version": "1.5.0", "dependencies": { "ws": "^8.0.0" } }
Confidence: 92% confidence
Finding: The dependency is specified with a caret range (^8.0.0), which permits automatic installation of newer minor and patch releases instead of a single vetted version. This weakens supply-chain control and can unexpectedly pull in vulnerable or behavior-changing releases, which is especially relevant for a browser-control skill that connects to a privileged Chrome DevTools endpoint.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/browser.js:38