Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chrome debugging tool, but it gives an agent broad control over live browser tabs, including logged-in pages, raw CDP commands, and arbitrary JavaScript execution.
Install only if you want an agent to control a real local browser session. Avoid using it with sensitive logged-in tabs unless the task requires that access, be especially cautious with eval, evalraw, nav, open, click, and type, and stop the daemons when finished.
evalRawStr accepts any CDP method name and attacker-controlled JSON parameters, then forwards them directly to cdp.send. In the context of a skill meant for interacting with already-open pages, this is unjustified overbreadth and creates a powerful escape hatch that bypasses all higher-level safety assumptions or command restrictions.
The manifest presents the skill as a limited inspect/debug helper, but evalraw exposes arbitrary Chrome DevTools Protocol method execution. That effectively grants a generic browser-automation/control primitive, allowing actions far beyond inspection, including navigation, input synthesis, DOM manipulation, network interception-related methods, and data extraction from active tabs.
The skill exposes powerful local-browser control capabilities, including navigation, JavaScript evaluation, raw CDP passthrough, and access to live logged-in tabs, but it does not declare any explicit tool scope such as permissions or allowed-tools. Even though the README warns about sensitive content and explicit user intent, the absence of machine-readable scope limits increases the chance that an agent can invoke environment-backed capabilities more broadly than intended.
The eval feature runs arbitrary JavaScript in the page context, which can do much more than inspect state: it can click buttons, submit forms, alter DOM, trigger transactions, exfiltrate visible data, or abuse authenticated sessions. The only notice is a generic usage label, which does not meaningfully communicate the risk or constrain destructive use.
Arbitrary raw CDP execution is exposed as a normal command without a prominent safety boundary, even though it grants low-level browser control well beyond simple inspection. In a skill whose value proposition is interacting with open pages, the absence of strong warnings or restrictions increases the chance of misuse and surprise high-impact actions.
The skill description says it only interacts with pages the user already has open, but the open command creates entirely new tabs via Target.createTarget. This expands the tool's authority beyond its declared scope and enables unsolicited navigation to attacker-chosen sites, which is especially risky for a browser-control skill handling authenticated sessions.
Detected: suspicious.dangerous_exec
