Security audit

chrome-cdp-skill

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Chrome debugging tool, but it gives an agent broad control over live browser tabs, including logged-in pages, raw CDP commands, and arbitrary JavaScript execution.

Install only if you want an agent to control a real local browser session. Avoid using it with sensitive logged-in tabs unless the task requires that access, be especially cautious with eval, evalraw, nav, open, click, and type, and stop the daemons when finished.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: `evalRawStr` accepts any CDP method name and attacker-controlled JSON parameters, then forwards them directly to `cdp.send`. In the context of a skill meant for interacting with already-open pages, this is unjustified overbreadth and creates a powerful escape hatch that bypasses all higher-level safety assumptions or command restrictions.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The manifest presents the skill as a limited inspect/debug helper, but `evalraw` exposes arbitrary Chrome DevTools Protocol method execution. That effectively grants a generic browser-automation/control primitive, allowing actions far beyond inspection, including navigation, input synthesis, DOM manipulation, network interception-related methods, and data extraction from active tabs.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill exposes powerful local-browser control capabilities, including navigation, JavaScript evaluation, raw CDP passthrough, and access to live logged-in tabs, but it does not declare any explicit tool scope such as permissions or allowed-tools. Even though the README warns about sensitive content and explicit user intent, the absence of machine-readable scope limits increases the chance that an agent can invoke environment-backed capabilities more broadly than intended.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The `eval` feature runs arbitrary JavaScript in the page context, which can do much more than inspect state: it can click buttons, submit forms, alter DOM, trigger transactions, exfiltrate visible data, or abuse authenticated sessions. The only notice is a generic usage label, which does not meaningfully communicate the risk or constrain destructive use.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Arbitrary raw CDP execution is exposed as a normal command without a prominent safety boundary, even though it grants low-level browser control well beyond simple inspection. In a skill whose value proposition is interacting with open pages, the absence of strong warnings or restrictions increases the chance of misuse and surprise high-impact actions.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill description says it only interacts with pages the user already has open, but the `open` command creates entirely new tabs via `Target.createTarget`. This expands the tool's authority beyond its declared scope and enables unsolicited navigation to attacker-chosen sites, which is especially risky for a browser-control skill handling authenticated sessions.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/cdp.mjs:619