Security audit

bsession

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is not clearly malicious, but it asks for broad agent powers while promoting persistent sessions, login automation, scraping, and anti-bot bypass without enough limits or user controls.

Review this skill carefully before installing. Use it only for sites and accounts you are authorized to automate, avoid giving it credentials unless you understand how your agent stores sessions, and do not rely on it for compliant scraping or anti-bot circumvention without stronger guardrails from the publisher.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill advertises browser-session setup, navigation, interaction, extraction, and screenshot-return behavior, but the file provides only documentation and no concrete implementation or constrained execution flow. This mismatch is dangerous because users or agents may assume trustworthy support for website automation and data collection, causing unsafe invocation of exec/write capabilities under false expectations.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The FAQ introduces parameters and capabilities such as wait_for_js, browser_name, selector, and concurrency that are not defined in the main interface or backed by visible implementation. This is risky because an agent may infer unsupported control surfaces and perform unintended website interaction or command execution based on fabricated capabilities.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The description is broad enough to match generic productivity, automation, and workflow-improvement requests rather than a narrowly scoped browser-session task. In an agent ecosystem, this increases the chance of over-invocation, exposing exec, read, and write tools in situations where the user did not intend website automation or session persistence.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The usage section describes browser navigation, page interaction, data extraction, and session behavior without a clear warning that the skill may interact with third-party sites, collect page data, and create persistent sessions. This lack of disclosure is dangerous because users may not understand the privacy, consent, and persistence implications before the agent acts.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly lists file handling, API integration, and command execution capabilities, including executing system commands, but does not give a clear warning about system-impacting behavior. In context, the presence of exec and write tools makes this more dangerous because a broadly invoked skill could alter files or run commands under the guise of generic automation.

Ssd 2

Medium

Confidence: 97% confidence
Finding: The paid-feature table promotes automatic bypass of anti-bot strategies, which encourages evasion of website protections rather than legitimate automation. In a browser automation skill with session persistence and data collection, this materially raises abuse potential for unauthorized scraping, stealthy access, and circumvention of site controls.

Static analysis

No suspicious patterns detected.