tappi

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:08 PM UTC
• Version: 3.5.0

Overview

This is a disclosed browser-control skill, but it gives agents broad authenticated-browser control with raw JavaScript, file upload, and coordinate-click powers that need careful review.

Install only if you are comfortable giving an agent control of a signed-in browser. Treat eval, upload, paste-from-file, and click-xy as sensitive operations; require explicit user confirmation before using them on authenticated sites, payment or OAuth flows, captchas, destructive actions, or local files containing private data. Update or review the ws dependency before relying on it in sensitive environments.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile pins the skill to ws 8.19.0, and the supplied advisory information indicates this version is affected by an uninitialized memory disclosure and a memory-exhaustion denial-of-service issue. In this skill, a WebSocket client is used to control a browser via the Chrome DevTools Protocol, so compromised or malicious endpoints, unexpected intermediaries, or hostile local services could potentially trigger data leakage or crash/resource exhaustion in the agent process.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The package depends on ws 8.19.0, which the finding identifies as having known vulnerabilities including memory disclosure and memory-exhaustion denial of service. Because this skill provides browser control over the Chrome DevTools Protocol via WebSockets, flaws in the WebSocket library are especially relevant: an attacker able to influence or interact with that channel could potentially crash the process or expose sensitive data from browser sessions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill exposes browser automation with network access and environment-dependent configuration (CDP_URL) but does not declare any explicit tool scope or permission boundaries. In an agent setting, this increases the chance the skill is invoked for arbitrary browsing against authenticated sessions without clear policy gating or user awareness.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

Alias setup (optional)

bash

mkdir -p ~/.local/bin
cat > ~/.local/bin/bjs << 'WRAPPER'
#!/bin/bash
exec node /path/to/scripts/browser.js "$@"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents direct local file upload to websites via DOM.setFileInputFiles but does not warn that this transmits local files off-host to remote services. In an agent workflow, that omission can lead to accidental exfiltration of sensitive local documents, images, or credentials-bearing files through an authenticated browser session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The coordinate-click guidance explicitly covers captchas, payment forms, and OAuth widgets, which are sensitive contexts where a blind click can authorize transactions, account linking, or anti-bot challenges without meaningful verification. Because coordinate actions bypass DOM-level visibility and semantic checks, they are especially risky for irreversible or security-relevant actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill exposes an arbitrary eval <js> command that executes attacker- or prompt-controlled JavaScript in the context of whatever page the browser is currently logged into. That goes beyond ordinary navigation/form automation and enables direct access to page DOM, tokens, sensitive form contents, and authenticated application actions, substantially increasing the blast radius if an agent is manipulated.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The coordinate-based commands are explicitly positioned for use with cross-origin iframes and captchas, which bypasses the safer indexed-element interaction model and facilitates automation of UI regions the tool cannot semantically inspect. In an agent setting, this can be used to click opaque security challenges, embedded payment/auth flows, or other sensitive controls without meaningful policy checks or visibility.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with a caret range ("^8.19.0"), which allows automatic installation of newer minor/patch releases without explicit review. That is a supply-chain risk because builds are less reproducible and a compromised or breaking upstream release could be pulled in unexpectedly. In this browser-control skill, the dependency participates in WebSocket communication with Chrome DevTools, so dependency integrity matters.

Content

Scanner excerpt · scripts/package.json (reported line 5)May include surrounding context.

json

"name": "browser-js",
  "version": "1.6.0",
  "dependencies": {
    "ws": "^8.19.0"
  }
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/browser.js:38