T09 · Insecure Skill Coding Practices
- Location
SKILL.md:165- Finding
Authenticated Session Cookie Exposure Through CDP
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:165-170
Vulnerability Type: Extraction and return of HttpOnly authentication cookies
Risk Level: HighVulnerable Code
javascript const { cookies } = await cdpSession.send('Network.getCookies', { urls: [targetUrl], }); const cookieHeader = cookies .map(c => `${c.name}=${c.value}`) .join('; ');Technical Analysis
The Skill instructs the Agent to use the Chrome DevTools Protocol to extract cookies, including cookies protected by the
HttpOnlyattribute. It then combines their names and values into a reusable HTTPCookieheader.HttpOnlynormally prevents page JavaScript from accessing session cookies, reducing the risk of credential theft through script execution. CDP operates outside that browser security boundary and can retrieve these protected values. Returning the resulting header moves bearer-equivalent authentication credentials from the browser's cookie store into Agent output, transcripts, logs, or downstream tools.Cookie extraction is not required for the Skill's primary browser-navigation, clicking, rendering, screenshot, or DOM-extraction capabilities. Unconditionally supporting raw cookie export therefore exceeds the minimum privileges necessary for most declared functionality.
No fixed attacker-controlled destination or explicit third-party exfiltration endpoint was found. The vulnerability is nevertheless exploitable when an untrusted task, prompt, webpage, or downstream component induces the Agent to invoke the cookie-export operation and disclose its result.
Attack Path
- A user starts a normal, authenticated Edge or Chrome profile with remote debugging enabled.
- The Skill connects to that browser through CDP.
- The user processes an untrusted request or webpage that causes the Agent to invoke the documented cookie-retrieval operation for an authenticated origin.
Network.getCookiesretrieves c ...[truncated 1208 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
get_cookiesaction and raw cookie-export example unless exporting credentials is an essential, explicitly documented requirement. - Keep authentication cookies inside the browser rather than returning them to the Agent, user-visible output, logs, or downstream tools.
- If cookie-assisted requests are indispensable, perform them inside a narrowly scoped trusted component and return only the non-sensitive response data.
- Require explicit, per-operation user confirmation before accessing cookies, clearly identifying the requested origin and explaining that session credentials are involved.
- Enforce a strict allowlist of approved HTTPS origins. Reject wildcard domains, redirects to unapproved origins, and arbitrary user-supplied cookie targets.
- Never construct or return a complete reusable
Cookieheader. Return only non-sensitive metadata such as cookie count, domain, expiration, and security attributes when needed for diagnostics. - Completely redact cookie values from console output, execution logs, error messages, Agent transcripts, screenshots, and telemetry.
- Use a dedicated disposable browser profile rather than the user's ordinary logged-in profile, and grant that profile access only to accounts required for the current task.
- Bind the debugging interface to loopback, prevent remote access to the CDP port, and close the debugging session immediately after use.
- Add automated tests that fail if cookie values, authorization headers, session tokens, or other credentials appear in returned results or logs.
- Remove the