Security audit
Security checks for vulnerabilities and agentic risk
This browser automation skill is mostly coherent, but it gives agents several sensitive powers that are not clearly warned about or scoped for users.
Install only if you are comfortable letting an agent control browser sessions and potentially authenticated accounts. Avoid using real Chrome profiles, cookie export/import, `profile sync --all`, raw CDP cookie/network commands, and `tunnel <port>` unless you explicitly intend that access; tunneling can make a local service reachable from the internet.
The skill advertises website interaction but also includes the ability to expose local ports to the public internet through tunnels. This is a materially different and riskier capability that can publish internal development services or private data to external parties if invoked improperly.
The tunnel feature exposes a local service to the public internet, which can unintentionally publish private applications, data, or admin interfaces. Omitting a strong warning in a skill meant for browser automation makes accidental high-risk exposure more likely.
Local tunnel creation is not necessary for ordinary browser automation and creates a direct path for exposing local services externally. In an agent context, this can turn a browsing helper into a network publication mechanism with significant security consequences.
Profile sync can upload browser profiles that may contain browsing history, cookies, tokens, and saved credentials to a cloud service. Without prominent disclosure and consent, this creates a serious privacy and account-compromise risk.
Connecting to the user's existing Chrome profile grants access to active logins, cookies, and browsing context, allowing the agent to act as the user on authenticated sites. Without explicit risk disclosure and consent, this can lead to privacy violations or unintended account actions.
Cookie retrieval, export, import, and clearing directly manipulate sensitive session material that can disclose or alter authenticated state. Documenting these operations without clear safeguards increases the risk of session theft, account disruption, or unintended data exposure.
The skill is presented as browser automation, but it also exposes cloud account provisioning and arbitrary REST passthrough to an external service. That expands capability beyond the declared purpose and can enable unreviewed outbound actions, data transfer, and account creation without clear user awareness.
The cloud API section permits saving API keys locally and sending requests to an external service, but does not clearly disclose credential persistence or remote data transmission. Users may unknowingly store secrets on disk or exfiltrate browsing-related data to third-party infrastructure.
The reference explicitly advertises browser-level control beyond ordinary web automation, including network interception and direct Chrome target manipulation. In a skill presented as browser automation for testing and form filling, exposing these undocumented privileged capabilities materially expands what an agent can access and manipulate, including sensitive traffic and session state.
Network interception is a powerful surveillance and tampering capability that exceeds the stated browser automation purpose and can capture credentials, tokens, request bodies, or alter traffic in flight. Even though only mentioned as a use case here, documenting and normalizing that capability without strong justification increases the likelihood of misuse.
Documenting browser._run(coroutine) and browser._session gives callers arbitrary access to internal browser session objects and async execution, effectively bypassing any higher-level safety boundaries the CLI may impose. That turns the skill from constrained browser automation into a general-purpose privileged browser control surface.
The documentation includes a recipe for retrieving cookies through CDP, which can expose authentication tokens and other session secrets. Because the skill description does not disclose secret extraction capability, this creates a significant confidentiality risk and enables account/session compromise if misused.
The cookie access example presents sensitive session data extraction as a normal operation and does so without any warning about the confidentiality implications. In the context of a browser automation skill, this lowers the barrier to exfiltrating secrets and may mislead users about the sensitivity of the operation.
No suspicious patterns detected.
