Chrome Devtools Axi

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:22 AM UTC
• Version: 1.0.0

Overview

The skill is coherent browser-automation guidance, but it repeatedly tells agents to run mutable, unpinned npm code that can attach to Chrome sessions.

Review carefully before installing. Prefer a pinned, reviewed version of `chrome-devtools-axi`, avoid `npx -y` latest-version execution for sensitive work, and do not connect it to normal Chrome profiles, authenticated DevTools endpoints, or secret-bearing WebSocket headers unless you trust the exact installed package version and need that scope.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:82

Finding

Unpinned npm Package Is Downloaded and Executed Without Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:82-98; additional usage appears in SKILL.md:134-135 and README.md:42-51
Vulnerability Type: Unverified third-party dependency execution
Risk Level: High

Vulnerable Code

markdown

## Setup and verification

The skill only teaches the agent how to use the tool. The actual CLI is the npm
package `chrome-devtools-axi`; source repo:
https://github.com/kunchenguid/chrome-devtools-axi

Prefer `npx` for one-off use so the CLI is installed on demand:

```bash
npx -y chrome-devtools-axi --help
npx -y chrome-devtools-axi

Use a global install only when repeated shell use matters:

bash

npm install -g chrome-devtools-axi
chrome-devtools-axi --help

text

The same unsafe execution pattern is also presented in `README.md`:

```bash
npx -y chrome-devtools-axi --help
npx -y chrome-devtools-axi open https://example.com

Or install globally for repeated shell use:

bash

npm install -g chrome-devtools-axi
chrome-devtools-axi --help

Technical Analysis

The documented commands download and execute the current npm release of chrome-devtools-axi without specifying an exact reviewed version, integrity hash, lockfile, or package provenance requirement. The -y option suppresses the normal installation confirmation, increasing the likelihood that an agent will execute newly retrieved package code automatically.

This repository contains only documentation and does not include the package implementation. Consequently, the package behavior, installation scripts, transitive dependencies, and future releases cannot be validated from the audited artifact. A compromised npm account, malicious new release, dependency compromise, or registry-resolution attack could therefore change the effective executable payload after this Skill has been reviewed.

Browser automation makes the exposure particularly significant. The external p ...[truncated 1935 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to an exact reviewed version, for example npx chrome-devtools-axi@X.Y.Z, rather than resolving the mutable latest release.
• Verify the package's published integrity digest, provenance, and publisher identity before execution.
• Maintain a lockfile for repeatable installation where the deployment model permits it.
• Remove -y from first-time execution so installation requires explicit user approval.
• Disable or carefully review npm lifecycle scripts where possible.
• Perform first execution in a sandbox with restricted filesystem, environment, and network access.
• Do not expose authenticated browser profiles, DevTools endpoints, or secret-bearing CHROME_DEVTOOLS_AXI_WS_HEADERS until the installed package version has been verified.
• Document a reviewed version and an update procedure requiring security review before changing it.

T08 · Insecure Dependencies

Warning

• Location: README.md:16

Finding

Skill Is Installed From a Mutable Remote Branch

Content

View full analysis

Vulnerability Details

File Location: README.md:16-24
Vulnerability Type: Mutable remote dependency installation
Risk Level: Medium

Vulnerable Code

markdown

### Hermes

```bash
hermes skills install https://raw.githubusercontent.com/tmchow/agent-skills/main/chrome-devtools-axi/SKILL.md

From an interactive Hermes session:

text

/skills install https://raw.githubusercontent.com/tmchow/agent-skills/main/chrome-devtools-axi/SKILL.md
/reload-skills
/skill chrome-devtools-axi

text

### Technical Analysis

The installation URL references the mutable `main` branch rather than an immutable commit or signed release artifact. Content returned by this URL can therefore change after the current audit without any change to the installation command.

A Skill file is executable in the broader agent-control sense: its instructions influence tool selection, command execution, data handling, and interaction with external services. If the repository account, branch, or delivery path is compromised, an attacker can replace the reviewed instructions with directives that cause agents to run unsafe commands or disclose information.

The installation procedure does not require a checksum, signature, commit identifier, or manual comparison against the reviewed content. Reloading and activating the remotely obtained Skill therefore creates a time-of-check/time-of-use gap.

### Attack Path

1. An attacker compromises the source repository, maintainer account, branch protections, or another component capable of changing content served from the `main` branch.
2. The attacker modifies `SKILL.md` to include harmful agent instructions.
3. A user or agent invokes the documented `hermes skills install` command.
4. Hermes downloads the current attacker-modified file from the mutable URL.
5. The user reloads Skills and activates `chrome-devtools-axi`.
6. The agent follows the substituted instructions, potentia
...[truncated 754 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the branch URL with a URL pinned to a reviewed Git commit.
• Publish versioned Skill releases and provide a cryptographic checksum or digital signature for each release.
• Require installers to verify the checksum or signature before loading the Skill.
• Protect release branches and tags with mandatory review, signed commits, and restricted maintainer permissions.
• Avoid automatically reloading remotely sourced Skill content unless the new revision has been reviewed.
• Document the expected commit identifier and a controlled update process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (36)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users/agents to execute npx -y chrome-devtools-axi without pinning a specific package version. That causes code to be fetched and executed at runtime from the package registry, so a compromised latest release, dependency hijack, or malicious republish could lead to immediate arbitrary code execution in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This command again recommends running an unpinned npx package directly, this time against a live URL target. In an agent skill context, that is more dangerous because the instruction is operational and likely to be copied or executed automatically, increasing the chance of supply-chain compromise turning into browser automation abuse or host-level code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The manifest/description itself instructs use of execute npx -y chrome-devtools-axi, embedding an unpinned fetch-and-run package pattern at the skill entry point. Because this is the primary advertised invocation, it normalizes executing mutable npm code and makes supply-chain compromise central to the skill's usage model.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill repeatedly instructs use of npx -y chrome-devtools-axi without a pinned version, which causes execution of whatever package version is current in the registry at runtime. In an agent skill context, this creates a supply-chain risk: a compromised maintainer account, malicious update, or dependency hijack could lead to arbitrary code execution on the host when the skill is followed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This line directs the agent to run npx -y chrome-devtools-axi --help without version pinning. Because npx fetches and executes code from npm, an unpinned package exposes the host to arbitrary code execution if the package or one of its resolved dependencies is maliciously updated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The unpinned npx -y chrome-devtools-axi --version invocation executes mutable remote package code. In a skill designed for agents, this is particularly risky because users may trust the recipe and run it automatically across environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This help command uses npx without pinning, so the executed code is determined by the latest npm state rather than a vetted artifact. That creates a classic supply-chain execution path with host compromise potential.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill instructs launching the tool via unpinned npx, allowing arbitrary future package updates to change the code being executed. Since this is a browser-automation tool with local filesystem and network access, exploitation could impact host integrity, secrets, and browsing sessions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Opening a page through unpinned npx -y chrome-devtools-axi open ... executes code from a mutable registry target. If that package is compromised, the attack occurs before any browser action and can run arbitrary local code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This click example still relies on an unpinned remote package execution path via npx. The danger is not the click action itself but that following the skill requires executing untrusted, version-floating code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The snapshot example invokes the tool through unpinned npx, creating supply-chain risk each time the command is followed. Agent operators may assume documentation commands are safe and reproducible when they are not.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This console inspection example executes an unpinned npm package and therefore inherits arbitrary code execution risk from npm package drift or compromise. The debugging context does not reduce the underlying execution risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The network example uses unpinned npx, meaning the actual code executed is not fixed. In an automation skill, that can turn routine diagnostic use into a code execution vector on the analyst's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The network-get example continues the same unpinned pattern and may also process network data while running untrusted tool code. A malicious package could exfiltrate captured responses, local files, or environment variables.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The stop command is still an unpinned npx execution. Even innocuous lifecycle commands remain dangerous when they implicitly download and run mutable third-party code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This help command instructs use of the latest package version from npm at execution time. That undermines reproducibility and enables a compromised publish to gain code execution wherever the skill is used.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The open example again depends on unpinned npx, exposing the environment to registry-based compromise. Because the skill is intended to be followed operationally, this is a real and recurring risk rather than mere documentation noise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The snapshot example runs mutable npm-delivered code. If the package is hijacked, the attacker can execute arbitrary commands before or instead of producing the snapshot.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The eval example is especially sensitive because it combines unpinned tool execution with browser-side script evaluation capabilities. A compromised package could abuse both local host access and active browser session access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The screenshot example still executes the package through an unpinned npx fetch-and-run path. This grants any malicious update an execution foothold on the system under the guise of routine browser automation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The browser URL connection example is more sensitive than average because it combines unpinned package execution with access to an existing DevTools endpoint, potentially exposing authenticated browsing sessions. A compromised package could inspect or manipulate the connected browser and exfiltrate sensitive data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This auto-connect example executes an unpinned package while attaching to the user's running Chrome. In context, that materially increases danger because the tool may gain access to live tabs, cookies, tokens, and private content if compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The user-data-dir example combines a persistent profile with unpinned package execution, creating both local code execution risk and exposure of long-lived browser state. This is more dangerous than a fresh ephemeral session because compromise may reveal stored logins, history, and session data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.