Security audit

Browser Automation

Security checks across malware telemetry and agentic risk

Overview

This is a powerful browser automation skill that can reuse logged-in browser sessions and promote stealthy scraping, so it needs careful review before installation.

Install only if you need high-privilege browser automation. Use a dedicated or ephemeral browser profile, avoid attaching it to your everyday logged-in Chrome unless you explicitly intend that, treat storage-state files and network captures like secrets, and review the install script before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to execute shell commands, including an installation script, but does not declare any permissions or safety boundaries for shell execution. In practice this creates hidden capability expansion: a caller asking for browser use may trigger arbitrary local command execution and environment modification without clear consent or policy gating.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as browser automation guidance, but the documented install flow and referenced behavior extend into package manager bootstrapping, project initialization, dependency synchronization, and private package index configuration. That mismatch is dangerous because users and orchestrators may authorize the skill for browsing while it also performs supply-chain-sensitive operations, network fetches, and local project modifications outside the declared purpose.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill documents persistence of cookies, sessions, user data, and logs, but does not prominently warn that sensitive browsing state may be retained across runs. In a browser automation context this increases risk of credential leakage, cross-task data exposure, and unintended reuse of authenticated sessions, especially on shared systems or multi-tenant agent environments.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation explicitly promotes attaching automation to a user's real logged-in Chrome session with its cookies, extensions, and active authentication state, which materially increases the chance of unintended access to sensitive accounts and private data. Although the file later describes some tab-visibility boundaries and Chrome consent behavior, it does not give a prominent upfront warning about the privacy implications, session-token exposure risk, or when a dedicated profile should be strongly preferred.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The example shows a plaintext secret (`"secret"`) being entered during a login flow without any warning about credential handling, masking, or secret-safe alternatives. In a browser automation skill that explicitly targets authenticated sessions and login-gated sites, this can normalize unsafe patterns, leading users to hardcode real credentials into scripts, logs, shell history, or source control.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script automatically installs `uv` by fetching and executing a remote installer script from the network, without integrity verification, pinning, or user confirmation. If the upstream host, transport path, or installer content is compromised, this becomes arbitrary code execution on the user's machine during dependency setup.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.