Browser History

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:16 PM UTC
• Version: 1.0.0

Overview

This skill openly helps search a named person’s Chrome history, but it lacks consent controls and includes unnecessary browser-hiding and unsafe temporary-copy instructions.

Review before installing. Only use this with explicit permission from the Chrome profile owner, and avoid the hide/minimize command. Prefer a revised version that uses safe query parameters, secure temporary files with cleanup, profile selection, URL redaction, and confirmation before opening any result.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:15

Finding

Command and SQL Injection Through Unvalidated Placeholder Substitution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-17, 22-24, and 59-61
Vulnerability Type: Unvalidated input interpolation in shell and SQL commands
Risk Level: High

Vulnerable Code

bash

sqlite3 ~/Library/Application\ Support/Google/Chrome/Default/History \
  "SELECT url, title FROM urls WHERE url LIKE '%TERM%' OR title LIKE '%TERM%' ORDER BY last_visit_time DESC LIMIT 10;"

bash

sqlite3 ~/Library/Application\ Support/Google/Chrome/Default/History \
  "SELECT url, title FROM urls WHERE url LIKE '%youtube.com/watch%' AND (url LIKE '%TERM%' OR title LIKE '%TERM%') ORDER BY last_visit_time DESC LIMIT 10;"

bash

open -a "Google Chrome" "URL_HERE"

Technical Analysis

The instructions encourage direct replacement of TERM and URL_HERE inside shell command text. They do not require parameterized SQL, argument-safe command construction, input validation, or escaping.

A search term containing SQL metacharacters can modify the intended query. More critically, because the SQL statement and URL are placed inside double-quoted shell arguments, shell substitutions such as command substitution may be evaluated if an agent constructs a command by inserting untrusted text into the documented template before execution.

Quoting a placeholder with double quotes is not a sufficient defense when untrusted content is incorporated into the shell command source itself. The resulting exposure depends on how the agent performs substitution, but the documented pattern makes unsafe execution likely.

Attack Path

1. An attacker persuades the user or agent to search for a specially crafted term or open a crafted URL.
2. The agent replaces TERM or URL_HERE directly in the documented command template.
3. The shell parses metacharacters or command substitutions contained in the inserted value.
4. The injected shell command executes with the privileges of the agent process, or inje ...[truncated 796 chars]

Remediation

View remediation

Remediation Suggestions

• Replace command templates with a dedicated script that accepts search terms as data rather than shell source.
• Use SQLite bound parameters instead of concatenating search terms into SQL statements.
• Invoke processes through an argument-array API without sh -c, bash -c, or equivalent shell evaluation.
• Validate URLs with a proper parser and allow only explicitly supported schemes such as https and, if necessary, http.
• Reject control characters and unexpected schemes such as file, javascript, and custom application handlers.
• Require user confirmation before opening any URL obtained from history.
• Add adversarial tests covering quotes, SQL comments, semicolons, command substitutions, newlines, and shell metacharacters.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:1

Finding

Unauthorized Browsing-History Access, Insecure Temporary Copy, and UI Concealment

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 1-7, 38-48, and 63-67
Vulnerability Type: Sensitive-data access without an authorization requirement
Risk Level: High

Vulnerable Code

markdown

# Skill: browser-history — Search Chrome History

Search Das's Chrome browsing history to find URLs, videos, sites he's visited before.

## Chrome History Location

~/Library/Application Support/Google/Chrome/Default/History

text

bash

cp ~/Library/Application\ Support/Google/Chrome/Default/History /tmp/chrome_history
sqlite3 /tmp/chrome_history "SELECT ..."

bash

osascript -e 'tell application "System Events" to set visible of process "Google Chrome" to false'

Technical Analysis

The skill explicitly targets a named person's Chrome history but does not require confirmation that the invoking user owns the profile or is authorized to inspect it. Browsing history is sensitive because URLs and titles can reveal identities, interests, health concerns, work activity, internal systems, and URLs containing tokens or query parameters.

The fallback procedure copies the history database to the predictable path /tmp/chrome_history. The instructions do not establish restrictive permissions, use a securely created unique temporary directory, prevent symbolic-link attacks, or remove the copied database after use. This can leave a plaintext copy accessible to other processes or retained beyond the skill run.

The instruction to hide Chrome through System Events is unnecessary for searching history and reduces user visibility into the agent's actions. It may also trigger accessibility or automation permissions that exceed the legitimate needs of a read-only history search.

Attack Path

1. The skill is invoked in a session with access to the target macOS account.
2. It reads the Chrome profile's History database without checking ownership or obtaining explicit consent.

...[truncated 1028 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed user authorization before accessing any browser profile or history database.
• Remove the person-specific targeting and operate only on a profile selected and confirmed by the current user.
• Explain what data will be queried and obtain confirmation before displaying URLs or titles.
• Apply data minimization by returning only records necessary for the stated request and redacting sensitive URL query parameters.
• Replace the predictable temporary path with a securely created, unique temporary directory owned by the current user and restricted to mode 0700; restrict copied files to mode 0600.
• Reject symbolic links and verify the source and destination before copying.
• Delete temporary database copies reliably on success, failure, interruption, and process termination.
• Prefer opening the SQLite database read-only or using a safe snapshot mechanism where feasible.
• Remove the Chrome-hiding instruction because it is unnecessary and conceals agent activity.
• Avoid requesting System Events or accessibility permissions unless they are indispensable and separately approved by the user.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill is explicitly framed around searching a specific person’s Chrome browsing history, which directly enables collection of sensitive personal activity data. In this context, the named-target framing makes the capability more dangerous because it suggests surveillance of an individual rather than a general administrative or forensic use case.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The SQL commands enumerate URLs, titles, recent visits, and most-visited sites, enabling direct extraction of private browsing records. Because the skill packages these queries as easy natural-language retrieval steps, it lowers the barrier to exfiltrating sensitive behavioral data such as interests, work activity, health research, or account usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill immediately instructs access to a named person’s Chrome history without any privacy warning, consent check, or limitation on use. Browsing history is highly sensitive personal data, so omitting a warning materially increases the risk of unauthorized surveillance and disclosure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workaround for copying the locked History database is designed to bypass normal application locking and continue reading sensitive browsing records. While not a security bypass in the strict exploit sense, it materially increases the ability to access private data despite runtime protections that would otherwise slow or deter casual access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented scope claims to search browsing history, but the later instructions add operational actions that control Chrome state. This mismatch is dangerous because it normalizes unexpected side effects beyond the user’s likely consent, increasing the chance of stealthy or unauthorized interaction with the browser.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill’s stated purpose is searching Chrome history, but it also includes commands to open URLs in Chrome and hide/minimize the browser. That expands the capability from passive data access into active browser and UI manipulation, which can be abused to conceal actions or trigger unwanted browsing activity on the user’s machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions to open URLs and hide Chrome change browser and UI state without any user-facing warning. Even if the commands appear simple, presenting them without caution encourages covert or non-consensual activity and obscures what the skill may do on the system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.