Browser Automation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:28 AM UTC
• Version: 0.0.5

Overview

The skill is a coherent browser automation tool, but it needs Review because its installer can execute mutable remote code and its runtime can retain or access sensitive browser session data.

Review the install script before running it. Prefer preinstalling uv through a trusted package manager, pin bridgic-browser to a reviewed version, and run this in an isolated project or user/container. Use --clear-user-data or a separate BRIDGIC_HOME for sensitive browsing, avoid CDP against your everyday Chrome profile unless needed, and treat screenshots, storage files, and network captures as sensitive.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install-deps.sh:205
• Finding: Unverified Remote Installer Scripts Are Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install-deps.sh:205-215` **Vulnerability Type**: Remote download and immediate code execution **Risk Level**: Critical ### Vulnerable Code ```bash if ! command -v uv &>/dev/null; then echo "uv not found — installing ..." case "$(uname -s)" in CYGWIN*|MINGW*|MSYS*|Windows_NT*) powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex" \ || { echo "Error: uv installation failed on Windows." >&2; fail "uv_install_failed" 1; } ;; *) curl -LsSf https://astral.sh/uv/install.sh | sh \ || { echo "Error: uv installation failed." >&2; fail "uv_install_failed" 1; } ;; esac ``` ### Technical Analysis When `uv` is unavailable, the script retrieves an installer from `https://astral.sh` and passes the response directly to a command interpreter. The Unix branch uses `curl | sh`, while the Windows branch uses `irm | iex` together with an execution-policy bypass. No version pin, cryptographic checksum, digital-signature verification, or local review step is applied before execution. HTTPS protects the transport connection but does not ensure that the retrieved script is immutable or that a compromised upstream service cannot return altered commands. Although Astral is a recognized software vendor and automatic installation is convenient, immediate remote execution is not the minimum access necessary for the Skill. The installer could instead require a preinstalled `uv` binary or verify a versioned release artifact before executing it. ### Attack Path 1. A user follows the installation instructions in `SKILL.md` and invokes `scripts/install-deps.sh`. 2. The script determines that `uv` is not present in `PATH`. 3. An attacker compromises the upstream host, its deployment process, DNS or certificate trust path, or another component capable of altering the returned installer. 4. The a ...[truncated 1132 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove both direct remote-execution pipelines: - Do not use `curl ... | sh`. - Do not use `irm ... | iex`. - Do not bypass PowerShell execution policy. 2. Prefer requiring `uv` to be installed separately through a trusted operating-system package manager. If it is unavailable, terminate with explicit instructions rather than installing it automatically. 3. If automatic installation is required: - Pin a specific `uv` release. - Download a versioned artifact to a temporary file. - Verify it against a hard-coded, reviewed SHA-256 checksum or a trusted digital signature. - Abort on any verification failure. - Execute only the verified local artifact. 4. Use a securely created temporary directory with restrictive permissions and ensure cleanup through a trap. 5. Document the exact version and expected publisher so dependency updates become explicit review events. 6. Run installation with a non-administrator account and avoid requesting privileges not required to create the project-local environment. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/deps.ini:17
• Finding: Runtime Package Is Installed Without an Exact Version Pin<![CDATA[ ## Vulnerability Details **File Location**: `scripts/deps.ini:17-18`; installation behavior at `scripts/install-deps.sh:285-308` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code Dependency declaration: ```ini [bridgic-browser] source = "default" ``` Resolution and installation logic: ```bash TO_INSTALL=() for i in "${!PKG_NAMES[@]}"; do name="${PKG_NAMES[$i]}" version="${PKG_VERSIONS[$i]}" if [ -n "$version" ]; then TO_INSTALL+=("${name}${version}") echo "→ ${name}${version} (re-pinning from config)" elif is_installed "$name"; then echo "✓ ${name} already present (no version pinned in config)" else TO_INSTALL+=("$name") echo "→ ${name} (missing, will install latest)" fi done if [ ${#TO_INSTALL[@]} -gt 0 ]; then echo "" echo "Running: uv add ${TO_INSTALL[*]}" run_uv "uv_add_failed" 3 uv add "${TO_INSTALL[@]}" fi ``` ### Technical Analysis The `bridgic-browser` dependency uses the public default package index but specifies no exact version. In a new project, the installer consequently runs the equivalent of: ```bash uv add bridgic-browser ``` This resolves the package version available at installation time rather than a version whose code was reviewed together with the Skill. Installations performed at different times may therefore execute different package code. The dependency is especially security-sensitive because it provides browser automation, cookie and storage access, file upload and download, network inspection, JavaScript evaluation, persistent browser profiles, and CDP connections to authenticated Chrome sessions. A compromised package release could abuse those capabilities. The reviewed configuration indicates public PyPI rather than a suspicious private index, and no evidence was found that the current package is intentionally malicious. The risk arises from allowing future, mutable releases to enter the e ...[truncated 1431 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add an exact, audited version constraint to `scripts/deps.ini`, for example: ```ini [bridgic-browser] source = "default" version = "==X.Y.Z" ``` 2. Commit and enforce a `uv.lock` file so all transitive dependencies resolve reproducibly. 3. Use package hashes or a trusted artifact-signing mechanism where supported. 4. Treat every version update as a security review event: - Review release notes and source changes. - Validate package provenance. - Run automated tests in an isolated environment. - Update the exact pin and lock file only after approval. 5. Consider an internal, access-controlled package mirror that permits only reviewed artifacts, while retaining strict package identity and integrity checks. 6. Run browser automation in an isolated account or container and use ephemeral browser profiles by default when persistent authenticated state is not required. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill presents itself primarily as a browser automation capability, but it also directs dependency installation, project initialization, pyproject modification, and browser binary setup. That mismatch is dangerous because users or orchestration systems may grant it for browsing tasks without realizing it can alter the local development environment and install software, creating a pathway for supply-chain or persistence-related risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly instructs execution of shell commands, including an installation script, but declares no tool scope or allowed-tools restrictions. In practice this widens the skill's effective authority and makes it easier for the agent to invoke shell unexpectedly, increasing the risk of unauthorized command execution or environment changes.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The activation text is extremely broad ('any task requiring a real browser', 'general web automation', 'prefer this over WebFetch'), which can cause over-invocation on many generic tasks. Over-broad triggering increases exposure to a high-capability browser-and-shell workflow, including authenticated browsing, stealth behavior, and local environment setup, even when a lower-risk tool would suffice.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- If exploration involves repeatedly clicking items in a list, you do not need to traverse every item (especially when the list is large).
- If login, verification, or authorization is required during exploration, pause and ask the user to complete it manually, unless the user explicitly provides instructions in the task.
- To avoid operating on websites too frequently, maintain human-like access intervals during both exploration and coding. You may simulate random wait times to reduce the risk of being blocked. Note: the `bridgic-browser wait` command parameter is in **seconds**, not milliseconds; for example, `bridgic-browser wait 2` or `bridgic-browser wait 3.2`.
- After finishing exploration and code writing, automatically run testing/validation.
- **CDP mode tab visibility**: when attached via `--cdp` to a user's running Chrome, `tabs` / `switch-tab` / `close-tab` only see pages bridgic itself opened (the initial blank tab plus anything spawned from it via `new-tab` or a click on a `target="_blank"` link). The user's other tabs are deliberately invisible to bridgic — never assume you can `switch-tab` into them. To work with such a tab, ask the user to navigate to it through bridgic, or use `new-tab <url>`.

## Reference Files

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill notes that browser profile data and sessions are persisted by default, but it does not surface this as a clear warning in the main description or require consent before use. That creates a privacy and credential-retention risk, especially for authenticated browsing, because cookies and session artifacts may remain on disk longer than the user expects.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide encourages use of network capture commands but does not warn that captured requests and responses can contain cookies, authorization headers, CSRF tokens, personal data, and internal service details. In a browser-automation skill that explicitly supports authenticated sessions and login-gated sites, this omission increases the chance that operators will collect, store, or share sensitive traffic unsafely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide states that the browser uses a persistent profile by default and that state survives across commands, but it does not clearly warn that cookies, local storage, and authenticated session state may be retained across runs. In this skill's context, which targets login-gated and stealth browsing workflows, that can lead to unintended account reuse, credential exposure, cross-task data leakage, or actions being performed under a prior user's session.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

| Key | Type / values | Notes |
|---|---|---|
| `enabled` | `true | false` | Default `true`. |
| `disable_security` | `true | false` | Disables security features (testing only). |
| `use_new_headless` | `true | false` | Default `true`. Use full Chromium binary with `--headless=new` instead of headless-shell. Only active when `enabled=true`, `headless=true`, and not using system Chrome (`channel`/`executable_path`). |
| `in_docker` | `true | false` | Auto-detected by default. |
| `permissions` | `string[]` | Default permissions for stealth context; top-level `permissions` overrides. |

• Confidence: 93% confidence
• Finding: The documented `disable_security` option explicitly allows disabling browser security protections. In the context of a browser automation skill that is used on arbitrary, dynamic, and login-gated sites, exposing a security-disabling flag materially increases the chance that users run sessions with weakened isolation, making exploitation by malicious web content more damaging.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This markdown file explains how to save and restore storage state, and notes that browser state is persisted by default in a user data directory. Because cookies, localStorage, and persistent profiles can contain sensitive authentication material, the skill description should clearly warn users about handling, securing, and reusing these files.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script persists the value of BRIDGIC_DEV_INDEX directly into pyproject.toml. If that index URL contains embedded credentials or tokens, they will be written to disk in plain text, potentially committed to source control, exposed to other users on the system, or leaked through logs and artifacts. In a dependency installer for a browser automation skill, private package feeds are plausible, so this is a realistic secret-exposure risk rather than a theoretical one.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: This markdown file includes example commands and SDK code that save a screenshot to `logged-in.png`, which affects local user data by writing browser-derived content to disk. The guide explains the mechanics of the operation but does not warn that screenshots may capture sensitive page contents or that the action creates a persistent file.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The natural-language example sets `locale` to `zh-CN` and `timezone_id` to `Asia/Shanghai`, which can be read as prescribing a specific locale configuration. The file does not indicate that this is optional or user-selected, so it risks violating language/locale policy guidance.

External Script Fetching

Low

• Category: Supply Chain

Content

|| { echo "Error: uv installation failed on Windows." >&2; fail "uv_install_failed" 1; }
            ;;
        *)
            curl -LsSf https://astral.sh/uv/install.sh | sh \
                || { echo "Error: uv installation failed." >&2; fail "uv_install_failed" 1; }
            ;;
    esac

• Confidence: 97% confidence
• Finding: The script downloads and immediately executes a remote shell installer via `curl ... | sh`, giving full code-execution rights to whatever is served from that URL at runtime. If the upstream server, network path, TLS trust chain, or distribution endpoint is compromised, an attacker can run arbitrary commands on the host during installation. Because this skill is specifically intended to set up powerful browser automation tooling, compromising the installer can directly yield a high-value execution environment.

Static analysis

No suspicious patterns detected.