T09 · Insecure Skill Coding Practices
- Location
SKILL.md:48- Finding
Authenticated browser sessions are exposed through an insufficiently restricted CDP endpoint
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 48–61 and 107–130
Vulnerability Type: Unrestricted browser remote-debugging interface
Risk Level: Highpowershell taskkill /F /IM msedge.exe /T Start-Sleep 3 Start-Process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 Start-Process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\BrowserAutomation\Edge" Start-Process "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223javascript const r = await edge.evaluate(`document.title`); console.log(r.result.value); const r = await edge.evaluate(` JSON.stringify( Array.from(document.querySelectorAll('.item-card')).slice(0,5).map(c => ({ title: c.querySelector('.title')?.innerText, price: c.querySelector('.price')?.innerText })) ) `); const items = JSON.parse(r.result.value);Technical Analysis
The Skill directs users to enable the Chrome DevTools Protocol on fixed ports while explicitly promoting reuse of an authenticated browser session. It does not require an isolated, low-privilege browser profile, verify that the debugging endpoint is restricted to the local host, establish endpoint authentication, configure firewall restrictions, or require confirmation before performing sensitive browser actions.
CDP provides extensive browser control, including page enumeration, navigation, arbitrary JavaScript evaluation, screenshots, and interaction with authenticated pages. The JavaScript evaluation feature is necessary for the declared browser-automation functionality, but exposing a user's general-purpose authenticated profile is broader than the minimum privilege required. A dedicated automation profile would provide the needed functionality with substantially less access.
Attack Pat
...[truncated 1397 chars]
- Remediation
View remediation
Remediation Suggestions
- Require a dedicated automation profile through a unique temporary
--user-data-dir; do not reuse the user's primary browser profile. - State explicitly that the automation profile must contain only the accounts and permissions required for the current task.
- Require the debugging endpoint to bind exclusively to loopback and verify its listening address before automation begins.
- Add host firewall rules that reject non-local access to the debugging port.
- Avoid predictable fixed ports where practical, and verify that the selected endpoint belongs to the newly launched browser instance.
- Require explicit user confirmation before submitting forms, publishing content, changing account settings, making purchases, deleting information, or performing other state-changing actions.
- Restrict JavaScript evaluation to the intended origin and validate navigation targets against a user-approved allowlist.
- Close the debugging browser and remove temporary profile data when the task finishes.
- Warn users that CDP is effectively a privileged control interface and must not be exposed on an untrusted network.
- Require a dedicated automation profile through a unique temporary