Back to skill

Security audit

Chrome Bookmarks

Security checks across malware telemetry and agentic risk

Overview

This skill transparently reads local Chrome bookmarks and can open a chosen bookmark, with no evidence of hidden data theft, persistence, or destructive behavior.

Install only if you are comfortable with an assistant reading your Chrome bookmark names, folder paths, and URLs. Prefer using search/list first, confirm the exact URL before opening, and be cautious with bookmarks that use file:, javascript:, data:, or custom app schemes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
idx = int(keyword_or_index)
        if 0 <= idx < len(all_bm):
            url = all_bm[idx]["url"]
            subprocess.Popen(["open", url])
            return {"opened": True, "url": url, "name": all_bm[idx]["name"]}
    except ValueError:
        pass
Confidence
91% confidence
Finding
subprocess.Popen(["open", url])

subprocess module call

Medium
Category
Dangerous Code Execution
Content
keyword_lower = keyword_or_index.lower()
    for bm in all_bm:
        if keyword_lower in bm["name"].lower() or keyword_lower in bm["url"].lower():
            subprocess.Popen(["open", bm["url"]])
            return {"opened": True, "url": bm["url"], "name": bm["name"]}

    return {"opened": False, "error": f"No bookmark found matching '{keyword_or_index}'"}
Confidence
91% confidence
Finding
subprocess.Popen(["open", bm["url"]])

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill invokes Python, reads a local Chrome bookmarks file, and uses the shell-based `open` command, but it does not declare any permissions for file access, environment access, or shell execution. That mismatch is a real security and governance issue because users and policy engines cannot accurately assess or constrain what the skill can do, and the `open` action can trigger navigation to arbitrary bookmarked URLs, including dangerous schemes or phishing destinations.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill is described as a bookmark search/browse tool, but it also has application-launch capability through the OS URL handler. That broadens the attack surface from passive reading to active execution, especially because bookmarked URLs may include non-web schemes handled by local applications.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code opens matched bookmarks immediately, without showing the final URL or asking the user to approve the action. In an assistant context, ambiguous keyword matching can cause unintended navigation or launch of locally handled URI schemes, making this more dangerous than a normal CLI utility.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.