Security audit

浏览器自动化工具-免费版

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is not clearly malicious, but it asks for broad execution/browser authority while its instructions are overbroad and its optional remote browser behavior is under-disclosed.

Install only if you intend to use it for browser automation and can review each browser action before it affects a real account. Treat remote Browserbase mode as a separate privacy boundary, avoid real credentials or sensitive data unless explicitly approved, and do not let the skill run unrelated local commands or broad workflow automation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented primarily as a local Chrome automation tool, but later enables a remote browser service requiring API keys. This discrepancy can mislead users and agents about where browsing data is executed and transmitted, increasing the risk of unintended data exposure to third-party infrastructure.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The documentation expands the skill's claimed capability beyond browser automation into generic file handling, API integration, and command execution. That scope creep can cause an agent to invoke broader and riskier actions than users expect, including local command execution or access to unrelated resources.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: Claiming the free edition uses only local Chrome while later describing remote Browserbase/API-key behavior creates a misleading trust boundary. Users may assume all automation stays local when the skill may route activity through remote services, affecting confidentiality and compliance.

Vague Triggers

High

Confidence: 89% confidence
Finding: The skill description is broad enough to trigger on generic efficiency, workflow, or team-automation tasks rather than narrowly on browser automation. Over-broad routing increases the chance an agent will select this skill in inappropriate contexts and grant it read/exec/browser capabilities unnecessarily.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The standalone trigger section lacks concrete invocation constraints and does not specify prohibited scenarios. That ambiguity makes accidental or excessive activation more likely, especially given the skill's exec-enabled environment.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill demonstrates form filling, login interaction, and submission flows without warning about real-account use, credential entry, or sensitive-data handling. In a browser-automation context, that omission is risky because users or agents may automate authentication or submit secrets to live services without adequate safeguards.

Static analysis

No suspicious patterns detected.