Kimi Webbridge Desktop

• Outcome: Review
• Latest audit: Jul 23, 2026 · 6:32 AM UTC
• Version: 1.0.0

Overview

This skill openly provides powerful control over a user's real signed-in browser, but its activation scope and safeguards are too broad for that level of access.

Install only if you are comfortable letting the agent operate your real signed-in browser. Use it for explicit browser-automation tasks, avoid asking it to work in sensitive accounts unless you intend that, review actions before forms, uploads, purchases, messages, or account changes, and delete screenshot/PDF files from /tmp when they may contain private information.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs the agent to execute shell commands such as curl, bash, and jq against a local daemon, yet it declares no permissions or equivalent trust boundary information. That mismatch hides real execution capability from the platform and user, increasing the risk of unauthorized browser control and local script execution without appropriate review.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The skill says to use it whenever the user mentions generic terms like 'browser', 'webpage', 'open URL', or 'screenshot,' and even for 'simple-sounding browser requests.' In the context of a tool that operates the user's real authenticated browser, this broad trigger guidance can cause unnecessary or unintended activation on low-signal prompts, expanding the chance of sensitive actions being taken without sufficiently explicit user intent.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Although the metadata mentions 'actual login sessions,' the skill lacks a prominent safety warning and consent workflow explaining that actions occur inside the user's real signed-in browser context. In this context, even routine navigation, clicking, reading, or screenshots may expose private data or perform state-changing actions on behalf of the user.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file instructs the operator to run a remote install script via `curl ... | bash` without any adjacent warning that it will download and execute code from the network and overwrite the local skill installation. In a browser-control skill, this is especially sensitive because the installed component mediates access to the user's real browser sessions, so normalizing blind remote-script execution increases supply-chain and local compromise risk.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script writes screenshots of the user's real browser session to disk, defaulting to a predictable directory under /tmp, without any warning, restrictive permissions handling, or cleanup. Browser screenshots may contain credentials, PII, financial data, or private messages, and persisting them on disk increases exposure to other local users, processes, backups, or later accidental disclosure.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.potential_exfiltration

Shell script base64-encodes a local file and sends it over the network.

Critical

• Code: suspicious.potential_exfiltration
• Location: scripts/screenshot.sh:98