浏览器自动化(免费版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:34 AM UTC
• Version: 1.0.2

Overview

This browser automation skill is not clearly malicious, but it gives agents broad execution/browser authority and includes under-disclosed credential, callback, dependency, and long-running automation patterns users should review carefully.

Install only if you are comfortable letting the agent run local Node/Playwright commands, open user-provided URLs, scrape page contents, submit forms, and write local outputs. Avoid using real passwords with the provided login pattern, review any callback URL before use, prefer pinned dependencies or a locked project setup, and do not run the scheduled loop unless you can monitor and stop it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:275

Finding

Unpinned Playwright and Chromium Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 275 and 413-414
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Code

bash

npm install playwright

text

| Playwright | npm package | Required | `npm install playwright` |
| Chromium | Browser | Required | `npx playwright install chromium` |

Technical Analysis

The Skill instructs the Agent to install Playwright without specifying an audited version or requiring a lockfile. It also uses npx to download and install a Chromium artifact associated with the dynamically resolved Playwright version.

Package installation is necessary for the declared browser-automation functionality, but allowing the package and browser versions to change after the Skill has been reviewed exceeds the minimum predictable dependency behavior. The effective components executed by the Agent can differ between installations.

No evidence establishes that Playwright or its Chromium artifact is currently malicious. The vulnerability is the mutable, unverified supply-chain installation process rather than a confirmed malicious package.

Attack Path

1. A user invokes the Skill and follows its environment setup instructions.
2. The Agent runs npm install playwright without a pinned version or verified lockfile.
3. npm resolves the package version and transitive dependency graph available from the configured registry at execution time.
4. Package lifecycle scripts and installed components execute with the permissions of the Agent user.
5. If the registry, package, maintainer account, dependency chain, or local npm configuration has been compromised, attacker-controlled code can execute locally.
6. The subsequent npx playwright install chromium command downloads an additional executable browser artifact without an integrity policy documented by the Skill.

Impact Assessment

A compromised dependency ...[truncated 581 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin Playwright to a specifically reviewed version, for example:

   bash

   npm install --save-exact playwright@<reviewed-version>
   

2. Include and review package.json and package-lock.json.
3. Use npm ci rather than dynamically resolving dependencies with npm install.
4. Verify lockfile integrity hashes and use an explicitly trusted npm registry.
5. Disable unnecessary package lifecycle scripts where compatible:

   bash

   npm ci --ignore-scripts
   

6. Install Chromium through a controlled build or artifact process and document the expected version and checksum.
7. Run browser automation in an isolated, unprivileged environment with restricted filesystem and network access.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:204

Finding

Login Password Exposed Through Child-Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 204-214
Vulnerability Type: Sensitive information exposed in process arguments
Risk Level: Medium

Vulnerable Code

python

def fill_login_form(url, email, password):
    form_data = {
        "email": email,
        "password": password
    }
    cmd = [
        "node", "fill-form.js", url,
        "--fields", json.dumps(form_data, ensure_ascii=False),
        "--submit", "true"
    ]
    run(cmd, capture_output=True, text=True)
    return json.loads(result.stdout) if result.returncode == 0 else {"error": result.stderr}

Technical Analysis

The login email and plaintext password are serialized into JSON and placed directly in the argument vector of the fill-form.js child process. Although submitting credentials to a user-selected login page is within the declared form-automation functionality, placing those credentials in process arguments is not necessary.

Depending on the operating system and host configuration, command-line arguments may be visible through process-listing utilities, process metadata interfaces, endpoint monitoring, debugging tools, crash diagnostics, shell or Agent telemetry, and execution logs. Any component that records the complete command can retain the password after the browser operation has ended.

The example also captures standard output and standard error. The referenced fill-form.js implementation is absent, so it cannot be determined whether that script logs the supplied fields or safely redacts passwords. The snippet contains implementation errors involving run and result, but the intended credential-passing pattern remains insecure if corrected and executed.

Attack Path

1. A user asks the Skill to authenticate to a website and supplies an email address and password.
2. The Skill serializes both values into form_data.
3. The complete JSON object, including the plaintext password ...[truncated 1344 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not place passwords, session tokens, or other secrets in command-line arguments.
2. Pass sensitive form values through protected standard input or another dedicated secret channel:

   python

   payload = json.dumps(form_data)
   result = subprocess.run(
       ["node", "fill-form.js", url, "--fields-stdin", "--submit", "true"],
       input=payload,
       capture_output=True,
       text=True,
       check=False
   )
   

3. Modify fill-form.js to read the payload from standard input and ensure it never logs password fields.
4. Redact keys such as password, token, secret, and authorization from debug output, errors, telemetry, and execution logs.
5. Avoid including credentials in exceptions or captured diagnostic output.
6. Limit process inspection and Agent log access to trusted users.
7. Require explicit user approval before submitting credentials and restrict submission to user-approved HTTPS origins.
8. Clear references to sensitive values as soon as practical and avoid persisting them to temporary files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes browser automation, scraping, and callback URLs without a clear warning that user-provided data, visited URLs, page contents, and callback payloads may be transmitted to third-party systems. In this context, that omission is security-relevant because users may unknowingly cause sensitive data to be sent off-host or to untrusted destinations through automated browsing and asynchronous callbacks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The line says executions support 创建/查询/导出 operations, which semantically includes export capability. Later, the limitations section explicitly states that page screenshots and PDF export are not available in the free edition (L446-L447), creating a direct contradiction in documented intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s activation/scope language is overly broad and overlaps with generic productivity and workflow requests, making it easier for an agent to invoke this skill in situations not clearly intended by the user. In a browser automation skill with exec, write, network access, scraping, and form submission examples, overbroad triggering increases the chance of unintended external actions or data handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation includes automated login form submission using supplied credentials but does not warn about credential sensitivity, account-impacting actions, or the need for explicit user authorization. This is dangerous because it normalizes sending secrets to external sites and performing state-changing actions in a browser automation context, potentially leading to credential leakage, unauthorized logins, or account abuse.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest repeatedly positions the skill as a free edition focused on a single-page, lightweight flow and explicitly says batch URL handling is not supported (L42-L45, L384-L386). However, the scheduled daily_price_check loop continuously performs automated fetches on a recurring basis, which contradicts that constrained positioning and suggests broader automation behavior than the stated free-scope limitations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to run npx playwright install chromium without pinning a specific Playwright version. This allows the executed package version to vary over time based on registry state, which harms reproducibility and increases supply-chain risk if a compromised or breaking release is pulled at install time. In this skill context, the risk is elevated because the skill explicitly enables exec and directs command execution on the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The display name, summary, and nearly all user-facing documentation are presented in Chinese, while the file does not state that the skill is region-specific or offer an opt-in language choice. Under the language/locale policy, forcing a specific language without user choice can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.