Security audit

Browser Automation Cdp

Security checks for vulnerabilities and agentic risk

Overview

This skill needs Review because it gives an agent access to logged-in browser sessions and includes unsafe guidance about private account data and browser cookies.

Install only if you are comfortable letting an agent drive a logged-in browser. Use a separate browser profile when possible, avoid using it on sensitive accounts, do not let it read browser cookie databases, and confirm the exact site and data scope before any authenticated automation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The Minimax section materially expands the skill from generic browser automation into guided extraction of authenticated account/quota information from a logged-in session. In the context of a skill that explicitly leverages the user's existing browser login, this creates a clear risk of unauthorized access to private service data and enables account reconnaissance beyond the manifest's stated scope.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Advising users to read full browser cookies from SQLite storage files bypasses normal browser security boundaries and directly targets credential material, including session tokens inaccessible to page JavaScript. In a skill built around attached logged-in browsers, this creates a straightforward path to credential theft and session hijacking.

Intent-Code Divergence

High

Confidence: 89% confidence
Finding: The documentation claims risk code was removed and security improved, but later includes instructions to obtain complete cookies from browser storage. This contradiction is a red flag because it can lower user suspicion while the skill still documents credential-access techniques, increasing the chance of unsafe deployment.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: Broad trigger keywords such as 'chrome', 'browser', '执行', and 'automation' can cause unintended activation in contexts unrelated to this skill's sensitive capabilities. Because the skill operates against an already logged-in browser session, accidental invocation raises the chance of unintended interaction with authenticated pages and private data.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The description highlights use of an already logged-in browser but does not clearly warn that this grants access to authenticated content, personal data, and account state. Omitting that warning is dangerous because users may not understand that ordinary automation requests can operate with their live session privileges.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The setup instructions include forcefully terminating browser processes, which can destroy active work, interrupt sessions, and affect unrelated tabs or applications without adequate warning. For a documentation-driven skill, destructive operational steps without safeguards increase the risk of user harm and accidental data loss.

Missing User Warnings

High

Confidence: 97% confidence
Finding: Guidance about reading browser cookie storage omits any warning that these files contain highly sensitive authentication material. In practice, this normalizes credential extraction and makes misuse more likely, especially in a skill already designed to operate within a logged-in browsing context.

Ssd 3

High

Confidence: 96% confidence
Finding: The skill explicitly instructs use of the user's logged-in browser session for navigating sites, interacting with pages, and extracting data. This is inherently sensitive because any automation attached to an authenticated browser can access private content and act with the user's account privileges.

Ssd 3

High

Confidence: 98% confidence
Finding: The Minimax example gives a concrete workflow for reaching a private account page, triggering internal navigation, and extracting plan/quota information from authenticated content. This is dangerous because it operationalizes access to private account metadata in a reusable way, enabling surveillance or misuse of a user's logged-in session.

Ssd 3

Critical

Confidence: 99% confidence
Finding: Suggesting direct extraction of complete cookies from browser storage files is effectively guidance for collecting session credentials outside the browser's intended security model. In context, this can be used to impersonate users, bypass HttpOnly protections, and take over authenticated sessions.

Static analysis

No suspicious patterns detected.