Chrome Bookmarks

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it reads local Chrome bookmarks so an assistant can search or open them, with no evidence of exfiltration or hidden persistence.

Install only if you are comfortable letting the skill read your Chrome bookmark names and URLs. Use search first for ambiguous keywords, confirm the exact destination before opening, and be cautious with bookmarks that may use non-web URL schemes or custom handlers.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes local Python scripts, reads the user's Chrome bookmarks file, and uses a shell-launched browser open action, but it declares no explicit permissions for file access, environment use, or shell execution. This creates a capability/consent mismatch: users and policy systems may treat the skill as less privileged than it actually is, increasing the risk of unexpected local data access or command execution pathways.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill opens bookmarked URLs immediately without any confirmation, preview, or scheme validation. In an agent context, this is risky because a user request like 'open my X bookmark' can trigger navigation to a malicious or sensitive local URL from the bookmark store, causing drive-by browser actions, exposure to phishing pages, or opening of non-web URI schemes.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal