Security audit
Security checks for vulnerabilities and agentic risk
The skill has legitimate browser-session management features, but it needs review because it can persist logged-in sessions, run Docker session commands, send webhook data, start long-running monitors, and advertises Cloudflare avoidance with overly broad activation text.
Install only if you intend to run authorized browser-session automation. Before use, restrict it to sites and sessions you control or have permission to automate, use dedicated webhook endpoints, avoid putting secrets in saved config or generated scripts, review ~/.bsession/workspace for retained files, and disable recurring monitors or automatic restarts unless you explicitly need them.
The skill states that secrets should be provided via environment variables, yet multiple examples embed webhook endpoints directly in code and configuration. Hardcoded webhook URLs can be copied into repositories, logs, and shared artifacts, enabling unauthorized message delivery, endpoint abuse, or disclosure of internal integration details.
The skill metadata and activation text describe project management and collaboration use cases, but the body actually enables browser-session automation, persistence, webhooks, monitoring, and command execution. This mismatch can cause the skill to be invoked in unrelated contexts without informed user consent, increasing the chance of unexpected execution, data handling, or external network actions.
The activation description is broad and inconsistent with the tool's actual purpose, including generic terms like project management and team collaboration. Overbroad activation increases the risk that an agent will select this skill for common requests, exposing users to command execution, file writes, and webhook behavior they did not intend.
The capability coverage section lists vague, high-overlap keywords such as planning, tracking, collaboration, and generic 'Use/when' phrases. In an agent-routing context, these broad triggers can misroute ordinary requests into a skill that can execute commands and send external webhooks, creating an unsafe expansion of scope.
The skill supports callback URLs and webhook notifications but does not clearly warn that task results, metadata, or failures may be transmitted to external endpoints. Without explicit disclosure and confirmation, users may unknowingly exfiltrate sensitive operational data to third-party services.
The session persistence feature says reusable config and Python scripts are saved, but it does not clearly warn that files are written to disk and may contain operational details, credentials, or automation logic. Silent persistence can create unintended long-term retention, local disclosure, and later execution risk.
Advertising 'Cloudflare automatic bypass/evasion' as a normal premium capability promotes circumvention of access controls and anti-bot protections. In a browser automation skill with exec and persistence features, this materially increases the likelihood of unauthorized scraping or policy-violating access.
Repeatedly normalizing Cloudflare bypass in feature descriptions lowers operator caution and frames anti-protection circumvention as routine. This is risky because it encourages misuse against protected targets and may expose users and operators to legal, contractual, and account-security consequences.
Listing Cloudflare bypass in the capability matrix presents circumvention as a supported product feature rather than an edge case or prohibited action. That positioning increases the chance of intentional misuse in real deployments.
The scenario describing scraping logged-in target sites while preserving authenticated sessions encourages automation against authenticated areas, which can expose personal or proprietary data and facilitate unauthorized access if misapplied. Persisted sessions also expand the blast radius if tokens or profiles are stolen or reused.
The feature list again markets automatic bypass as routine, reinforcing a misuse-oriented capability. Repetition in multiple sections makes the unsafe behavior more likely to be seen as endorsed and supported.
The generic webhook sender can post arbitrary title/content to any registered URL, creating a broad egress channel with minimal controls. In an agent skill context, that is more dangerous because other parts of the skill can pass scraped page content, operational state, or potentially sensitive data to attacker-controlled endpoints without validation.
def _send_generic(self, url, title, content):
"""通用Webhook"""
payload = {"title": title, "content": content, "timestamp": str(time.time())}
r = requests.post(url, json=payload, timeout=10)
return r.status_code == 200
notifier = WebhookNotifier()
This recurring task sends change data and alerts to a configurable webhook URL, and the message may include fetched page state or exception text. In an automation/agent setting, this creates a persistent exfiltration path where monitored content or internal error details can be continuously forwarded outside the environment.
import requests
payload = {"text": message, "session": self.name}
try:
requests.post(self.webhook_url, json=payload, timeout=10)
print(f"[{self.name}] Webhook已发送")
except Exception as e:
print(f"[{self.name}] Webhook失败：{e}")
The code passes an unvalidated session name into a privileged operational command and then returns command output and errors. Even though subprocess is invoked with an argument list rather than a shell, an attacker-controlled session identifier can still target unintended internal objects, trigger confusing or malicious control flow, and cause sensitive container output to be surfaced into logs, responses, or webhooks.
def check_health(self, session_name):
"""检查会话健康状态"""
try:
result = subprocess.run(
["docker", "exec", "agent-browser", "bsession", "show", session_name],
capture_output=True, text=True, timeout=10
)
The restart path uses an unvalidated name parameter in a control command capable of changing runtime state inside the container. If an attacker can influence the name list, they may restart unauthorized sessions or abuse error/output handling to disrupt operations and leak internals through logs and alert messages.
"""重启会话"""
print(f"尝试重启会话：{name}")
try:
subprocess.run(
["docker", "exec", "agent-browser", "bsession", "restart", name],
capture_output=True, text=True, timeout=30
)
The skill combines environment-derived configuration, browser/session automation, scraped content extraction, and multiple outbound webhook mechanisms, which forms a plausible exfiltration pipeline. Even though the visible example appears aimed at price monitoring, the same pattern could readily forward sensitive page content, session-derived data, or secrets referenced through environment variables to external services, making the agent context materially more dangerous.
port = int(os.environ.get("CDP_PORT", 9222))
ab(port, "open", "https://shop.example.com/product/123")
time.sleep(5)
snap = ab(port, "snapshot")
price_ref = find_ref(snap, "价格")
if price_ref:
price_text = find_ref(snap, "价格", extract=True)
No suspicious patterns detected.