Security audit

浏览器控制工具

Security checks for vulnerabilities and agentic risk

Overview

This browser-control skill can operate your logged-in Chrome session and run page JavaScript, but its scope and safety boundaries are too broad and inconsistent.

Review carefully before installing. Only use this with sites and accounts where you are comfortable letting an agent read page content and perform browser actions as you. Avoid sensitive accounts unless the skill is narrowed to explicit user-approved navigation, extraction, form filling, and script execution, and verify the required Chrome extension or bridge separately.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill is presented as a Chrome browser control tool, but later claims unrelated capabilities such as file handling, API integration, and system command execution. This scope expansion is dangerous because it can mislead users and agents about the actual trust boundary, potentially causing the agent to invoke broader local or network actions than expected.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The documentation first states that no extra API key is required, then elsewhere says some functions do require API keys. Contradictory security and setup guidance can cause unsafe operator assumptions, including entering secrets into the wrong place or enabling features without understanding their authentication model.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The file labels the skill as both EXEC-enabled and pure Markdown-only, which obscures whether it can perform active code or command execution. For a browser-control skill operating on a logged-in session, ambiguity about execution capability materially increases risk because users and policy layers may apply the wrong trust level.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The activation guidance is so broad that the skill may be selected for generic productivity tasks unrelated to browser automation. Because this skill can act on the user's logged-in browser session, overbroad routing increases the chance of unnecessary exposure of cookies, session data, page contents, and unintended web actions.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill directly operates on the user's logged-in Chrome session, but the description does not prominently warn about that privilege boundary. This is dangerous because authenticated browser control can expose private data, perform account actions as the user, and bypass normal API-level permission expectations.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill documents JavaScript execution in the user's browser context without a strong warning about the risks. Executing arbitrary page-context script can read sensitive DOM data, manipulate forms, trigger authenticated actions, and increase the blast radius beyond simple navigation or text extraction.

Static analysis

No suspicious patterns detected.