Chrome Devtools Mcp 1.0.0

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it should be reviewed because it persistently runs a mutable browser-control MCP package with broad access to Chrome sessions.

Install only if you trust the external npm package and are comfortable giving an agent control over the browser pages you expose. Prefer pinning a reviewed exact version instead of @latest, run it with a fresh or isolated Chrome profile, keep --no-usage-statistics and --no-performance-crux when privacy matters, and avoid connecting it to sessions with sensitive accounts or data. Upstream documentation also notes default usage statistics, optional CrUX behavior, and update checks. ([github.com](https://github.com/ChromeDevTools/chrome-devtools-mcp?utm_source=openai))

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup_chrome_mcp.py:43

Finding

Mutable npm Dependency Is Downloaded and Executed Without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description claims the skill is the Chrome DevTools MCP browser automation/testing server itself, with capabilities like clicking, navigating, screenshots, tracing, and debugging. However, this code chunk does not implement those browser-control features. Instead, it is an auxiliary setup/status/test utility for installing and verifying availability of the external chrome-devtools-mcp package and checking local configuration. That is a materially different primary purpose from the declared browser automation server behavior, so this is a description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This is a genuine tool-parameter abuse risk because the helper is designed to execute arbitrary shell command strings through subprocess.run(..., shell=True). In an agent or automation context, such a generic wrapper can easily become a dangerous sink if later wired to external input, enabling arbitrary OS command execution.

Content

Scanner excerpt · scripts/setup_chrome_mcp.py (reported line 15)May include surrounding context.

python

def run(cmd, capture=True, timeout=30):
    try:
        r = subprocess.run(cmd, shell=True, capture_output=capture, text=True, timeout=timeout)
        return r.returncode, r.stdout.strip() if capture else "", r.stderr.strip() if capture else ""
    except subprocess.TimeoutExpired:
        return 1, "", "timeout"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill exposes shell-capable behavior through installation and setup commands but does not declare any tool scope or allowed-tools boundaries. In an agent environment, missing explicit permission scoping increases the chance that the skill can invoke shell operations more broadly than users expect, weakening sandboxing and review controls.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Using npx with an unpinned package reference causes the environment to fetch whatever version is current at execution time, creating a supply-chain risk. If the upstream package, a dependency, or the publishing account is compromised, agents may execute attacker-controlled code automatically.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This command launches a browser-control MCP server from an unpinned npm package, so the code executed can change over time without review. Because the server gains powerful browser automation capabilities, a compromised release could exfiltrate data, drive authenticated sessions, or run arbitrary postinstall/runtime logic.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Connecting to an existing browser via a package resolved at runtime still requires trusting remote npm content at execution time. Since the package mediates access to a live Chrome debugging endpoint, compromise of the package could result in interception of page data, cookies, network traffic, and browser actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The OpenClaw integration example embeds an unpinned npx package into persistent configuration, making future executions silently consume whatever release is newest. This turns a one-time documentation issue into a recurring supply-chain exposure across all later agent sessions.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The helper wraps subprocess.run with shell=True and accepts an arbitrary cmd string, creating a reusable command-execution sink. Although current call sites are constant strings, this pattern is dangerous because future changes or indirect input flow could turn it into shell injection, and shell metacharacters would be interpreted by the system shell.

Content

Scanner excerpt · scripts/setup_chrome_mcp.py (reported line 15)May include surrounding context.

python

def run(cmd, capture=True, timeout=30):
    try:
        r = subprocess.run(cmd, shell=True, capture_output=capture, text=True, timeout=timeout)
        return r.returncode, r.stdout.strip() if capture else "", r.stderr.strip() if capture else ""
    except subprocess.TimeoutExpired:
        return 1, "", "timeout"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence

Finding

The script executes chrome-devtools-mcp@latest via npx, which fetches and runs the newest package version at runtime. Using @latest creates a supply-chain risk: behavior can change unexpectedly, a compromised upstream release would execute immediately, and the script's setup role makes users more likely to trust and run it.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

A setup/status helper is expected to inspect configuration or print instructions, but here it actively executes remote package code through npx during setup. That broadens trust requirements and creates unexpected code-execution risk in a script users may run for simple environment checks.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/setup_chrome_mcp.py (reported line 132)May include surrounding context.

python

# Try starting with --headless
    print("Starting MCP server (headless)...")
    proc = subprocess.Popen(
        ["npx", "-y", "chrome-devtools-mcp@latest", "--headless", "--no-usage-statistics"],
        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True
    )

Static analysis

No suspicious patterns detected.