Kimi WebBridge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:21 AM UTC
• Version: 0.1.0

Overview

This skill is for real-browser automation, but it grants broad authenticated browser control and includes automatic background/process behavior that users should review before installing.

Install only if you are comfortable giving the agent control of your real logged-in browser. Avoid using it on banking, identity, admin, healthcare, password-manager, or other sensitive sites, and require explicit confirmation before borrowing existing tabs, submitting forms, uploading files, saving to custom paths, or closing/killing browser processes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T06 · System Persistence

Error

• Location: SKILL.md:12
• Finding: Persistent Browser-Control Daemon Survives Sessions and Reboots## Vulnerability Details **File Location**: `SKILL.md:12-14` **Vulnerability Type**: Persistent scheduled-task service **Risk Level**: High ### Evidence The documentation states that `kimi-webbridge.exe` is maintained by the Windows scheduled task `KimiWebBridge-Watchdog`, starts at login, restarts every minute following a crash, and survives both WorkBuddy termination and system reboot. ### Technical Analysis The project relies on a persistent local daemon that provides access to the user's authenticated browser. A watchdog that automatically restarts this daemon significantly extends the lifetime of the browser-control surface beyond the task that required it. The repository does not contain the scheduled-task installation logic, so the audit cannot establish that loading this Skill installs the task. Nevertheless, the Skill expressly expects and preserves this persistent deployment. The recovery instructions also tell the agent to start the daemon automatically when it cannot be reached. Because the service remains available across sessions and reboots, compromise of the daemon, browser extension, local command endpoint, or an authorized local caller can provide durable access to future authenticated browser activity. ### Attack Path 1. The browser-control daemon is registered under `KimiWebBridge-Watchdog`. 2. An attacker obtains the ability to communicate with or influence the daemon or its connected extension. 3. The attacker uses the daemon to control an authenticated browser session. 4. The user exits WorkBuddy or reboots the computer. 5. The scheduled task starts or restarts the daemon, preserving the attack surface for subsequent sessions. ### Impact Assessment Successful exploitation can provide persistent access to a control channel capable of reading and manipulating authenticated browser pages. The scope includes any browser account or website accessible through the connected extension. Persistence also m ...[truncated 102 chars]
• Remediation: ## Remediation Suggestions - Remove automatic login startup and crash-restart behavior unless the user separately opts into persistent operation. - Start the daemon only for the duration of an explicitly authorized task. - Stop or disconnect the browser-control component after completing the task. - Require authenticated, per-session authorization for every daemon client. - Rotate session credentials whenever the daemon or extension reconnects. - Display a persistent user-visible indicator while browser control is active. - Document how users can inspect and remove the scheduled task. - Restrict the watchdog account, executable permissions, and scheduled-task modification permissions.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:29
• Finding: Unrestricted Control of Existing Authenticated Browser Sessions## Vulnerability Details **File Location**: `SKILL.md:29-52` **Vulnerability Type**: Excessive browser and account privileges **Risk Level**: Critical ### Evidence ```text | find_tab | url, active(bool) | ... | active:true borrows the tab the user is viewing | | evaluate | code (supports async/await) | ... | | cdp | method, params | raw CDP response | Raw chrome.debugger passthrough | | network | cmd(start|stop|list|detail), filter, requestId | request/response data | | upload | selector, files(string[]) | ... | Acting on a page the user already has open: pass active:true. It borrows the tab the user is currently viewing. The borrowed tab is operated in place. ``` ### Technical Analysis The Skill combines access to existing user tabs with arbitrary page JavaScript, raw Chrome DevTools Protocol commands, network inspection, file upload, form filling, and synthetic clicks. These operations execute in the context of the user's existing authenticated browser profile. No origin allowlist, sensitive-site exclusion, per-operation capability model, or mandatory confirmation requirement is specified. Raw CDP access is especially powerful because it can bypass the intended abstraction and expose browser capabilities not represented by the higher-level tools. Although browser automation is the stated purpose of the Skill, borrowing pre-existing tabs and exposing unrestricted low-level debugging interfaces exceeds the privileges needed for many ordinary navigation or scraping tasks. ### Attack Path 1. The user has an authenticated account open in the browser. 2. The agent invokes `find_tab` with `active:true` and borrows the user's current tab. 3. The agent invokes `snapshot`, `evaluate`, `network`, or raw `cdp` operations. 4. Sensitive page data or request information is collected. 5. The agent invokes `click`, `fill`, `upload`, `evaluate`, or `cdp` to change account state or submit an authenticated action. 6. The ...[truncated 656 chars]
• Remediation: ## Remediation Suggestions - Disable `active:true` by default and require explicit, contemporaneous user approval before borrowing an existing tab. - Limit each session to an explicit origin allowlist. - Block banking, identity, password-management, healthcare, administrative, and other sensitive origins by default. - Remove raw CDP access from the normal Skill interface or expose only a narrowly approved subset. - Require confirmation before form submission, file upload, purchase, message sending, account modification, or destructive action. - Redact credentials, authorization headers, cookies, tokens, and sensitive response bodies from network output. - Give newly opened automation tabs isolated browser profiles instead of reusing the user's normal authenticated profile. - Record an auditable log of accessed origins and state-changing operations.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:205
• Finding: Automatic Force-Termination of All Matching Quark Browser Processes## Vulnerability Details **File Location**: `SKILL.md:205-222` **Vulnerability Type**: Destructive wildcard process termination **Risk Level**: High ### Evidence ```powershell powershell.exe -NoProfile -ExecutionPolicy Bypass -File "$env:USERPROFILE\.kimi-webbridge\close_quark.ps1" ``` The documented helper logic is equivalent to: ```powershell Get-Process -Name "quark*" | Stop-Process -Force ``` The surrounding instructions state that this cleanup is performed automatically after delivering browser-task results and that it closes all matching Quark windows and background processes. ### Technical Analysis The cleanup procedure does not limit termination to processes or tabs created by the current automation session. Instead, it selects every process whose name matches the broad `quark*` wildcard and terminates each process forcibly. `Stop-Process -Force` does not provide applications with a reliable opportunity to save work or complete ongoing operations. The command can therefore affect unrelated user-owned browser windows, active downloads, updater processes, and any other process matching the wildcard. Use of `ExecutionPolicy Bypass` further weakens the execution boundary by suppressing the normal PowerShell policy check for the helper script. ### Attack Path 1. The user has one or more Quark windows or related processes open independently of the Skill. 2. A WebBridge task reaches its documented completion stage. 3. The Skill invokes PowerShell with `ExecutionPolicy Bypass`. 4. The helper enumerates every process matching `quark*`. 5. `Stop-Process -Force` terminates all matching processes, including those unrelated to the automation task. 6. Unsaved state and in-progress user operations are lost or interrupted. ### Impact Assessment The operation can terminate all of the user's Quark browser sessions, including unrelated windows and background components. Potential consequences include loss of un ...[truncated 311 chars]
• Remediation: ## Remediation Suggestions - Remove automatic application-wide process termination. - Use `close_session` to close only tabs created for the current task. - Require explicit user confirmation immediately before terminating any application. - Never use a wildcard process name for destructive process management. - If process termination is unavoidable, identify the exact executable path, process ID, ownership, and relationship to the current task. - Attempt graceful shutdown before force termination. - Remove `ExecutionPolicy Bypass`. - Detect unrelated user windows and refuse application-wide termination while they are open.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:120
• Finding: Caller-Controlled Screenshot and PDF Paths Permit Arbitrary File Overwrite## Vulnerability Details **File Location**: `SKILL.md:120-127` **Vulnerability Type**: Unrestricted local output path and overwrite **Risk Level**: High ### Evidence ```text screenshot: optional path returns a file path A caller-supplied path is honored verbatim (parent directories are created and an existing file is overwritten). save_as_pdf follows the same rule. ``` The same path semantics are reiterated for PDF output at `SKILL.md:160-166`. ### Technical Analysis Screenshot and PDF operations accept caller-supplied filesystem paths without documented canonicalization, destination allowlisting, overwrite protection, or symlink checks. Parent directories are created automatically, and an existing destination is replaced. This turns a content-export function into a general file-clobbering primitive for any path writable by the daemon. Even though the written data must be a screenshot or PDF, replacing a user file can cause data loss or alter the behavior of applications that consume the overwritten location. If path resolution follows symbolic links or directory junctions, an apparently safe output path could also resolve outside the intended directory. ### Attack Path 1. The attacker or compromised agent selects a sensitive path writable by the daemon account. 2. The attacker passes that path to `screenshot` or `save_as_pdf`. 3. The daemon creates missing parent directories if necessary. 4. The daemon opens the target path and overwrites any existing file. 5. The original file is destroyed or replaced with attacker-selected screenshot or PDF content. ### Impact Assessment Exploitation can destroy or replace user documents, configuration files, application state, or other writable files. The scope is bounded by the filesystem permissions of the daemon process but may include most files in the user's profile. Overwriting startup-sensitive or application-consumed paths could produce secondary ef ...[truncated 76 chars]
• Remediation: ## Remediation Suggestions - Restrict all generated files to a dedicated export directory. - Generate unique filenames rather than accepting arbitrary absolute paths. - Canonicalize the destination and verify that it remains inside the approved directory. - Reject path traversal, alternate data streams, symbolic-link escapes, and directory-junction escapes. - Open new files with exclusive-create semantics. - Require explicit confirmation before replacing an existing file. - Apply restrictive file and directory permissions. - Return an error if the destination already exists unless an independently authorized overwrite flag is provided.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:84
• Finding: Predictable Shared Temporary Request File Enables Command Substitution## Vulnerability Details **File Location**: `SKILL.md:84-95` **Vulnerability Type**: Unsafe temporary-file handling **Risk Level**: High ### Evidence ```python import json, os, urllib.request body = {"action":"navigate","args":{"url":"https://example.com","newTab":True,"group_title":"Example task"},"session":"my-task"} p = os.path.join(os.environ["TEMP"], "wb-webbridge-req.json") with open(p, "w", encoding="utf-8") as f: json.dump(body, f, ensure_ascii=False) req = urllib.request.Request("http://127.0.0.1:10086/command", data=open(p,"rb").read(), headers={"Content-Type":"application/json"}) print(urllib.request.urlopen(req, timeout=30).read().decode("utf-8","ignore")) os.remove(p) ``` ### Technical Analysis The recommended implementation uses the fixed filename `wb-webbridge-req.json` in the shared temporary directory. This contradicts the preceding requirement that every request use a unique randomly suffixed filename. The file is written, closed, and then reopened by pathname. That creates a time-of-check/time-of-use window during which another local process or concurrent Skill invocation can replace, modify, or redirect the file. A pre-created symbolic link or other filesystem redirection may also cause the write to affect an unintended target where supported. Cleanup is not protected by a `finally` block. Network failures or exceptions can leave request bodies on disk, potentially exposing URLs, entered text, session names, or other command arguments. ### Attack Path 1. An attacker predicts the fixed temporary path. 2. The legitimate process writes the intended browser command and closes the file. 3. Before the subsequent `open(p, "rb")`, the attacker replaces or modifies the file. 4. The process reads the substituted JSON. 5. The substituted command is sent to the local browser-control daemon under the legitimate workflow. 6. Alternatively, a failure before `os.remove(p)` leaves sensitive r ...[truncated 483 chars]
• Remediation: ## Remediation Suggestions - Avoid the temporary file entirely by sending the UTF-8 JSON bytes directly with `urllib.request`. - If a file is mandatory, use `tempfile.NamedTemporaryFile` or `mkstemp` with a cryptographically unpredictable name and restrictive permissions. - Keep the secure file descriptor open instead of reopening the file by pathname. - Reject symbolic links and reparse-point redirection. - Place cleanup in a `finally` block. - Do not log or persist sensitive request bodies. - Ensure concurrent requests never share a path. - Align the example implementation with the document's unique-filename requirement.

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:210
• Finding: Unreviewed User-Writable PowerShell Helper Is Executed with Policy Bypass## Vulnerability Details **File Location**: `SKILL.md:210-215` **Vulnerability Type**: External helper tool hijacking **Risk Level**: Critical ### Evidence ```powershell powershell.exe -NoProfile -ExecutionPolicy Bypass -File "$env:USERPROFILE\.kimi-webbridge\close_quark.ps1" ``` The project describes the expected behavior of `close_quark.ps1`, but the helper itself is not present in the audited repository. ### Technical Analysis The Skill directs the agent to execute a PowerShell script from a location under the user's profile. The script is outside the reviewed package, no cryptographic digest or signature is checked, and `ExecutionPolicy Bypass` explicitly suppresses normal execution-policy enforcement. A local attacker, compromised installer, or other process able to create or modify `close_quark.ps1` can replace the expected cleanup logic with arbitrary PowerShell. The command then executes the substituted script as part of a legitimate-looking task-completion workflow. This is a tool-hijacking condition because the trusted Skill delegates execution to an unverified external helper whose implementation can differ from the reviewed description. ### Attack Path 1. The attacker creates or modifies `%USERPROFILE%\.kimi-webbridge\close_quark.ps1`. 2. The replacement script contains arbitrary PowerShell commands. 3. The user asks the agent to perform any WebBridge browser task. 4. At task completion, the Skill invokes the expected helper path. 5. PowerShell runs the attacker-controlled script with the agent or user's current privileges. 6. The malicious commands execute while appearing to be routine browser cleanup. ### Impact Assessment Exploitation permits arbitrary command execution with the privileges of the process invoking PowerShell. Depending on those privileges, an attacker could read or modify user files, launch programs, alter user configuration, access local credentials available to the account, est ...[truncated 199 chars]
• Remediation: ## Remediation Suggestions - Include the helper in the reviewed Skill package rather than loading it from an external user-writable location. - Pin and verify a cryptographic hash or trusted digital signature immediately before execution. - Store executable helpers in a directory that untrusted processes and ordinary users cannot modify. - Verify file ownership, access-control entries, canonical path, and reparse-point status. - Remove `ExecutionPolicy Bypass`. - Replace the external script with a narrowly scoped built-in operation where possible. - Do not execute the helper automatically; require explicit user confirmation. - Abort safely if integrity verification fails or the helper is absent.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The invocation conditions are extremely broad and overlap with ordinary requests like opening a webpage, taking a screenshot, or searching the web. In this skill's context, broad auto-invocation is dangerous because the tool can control the real browser with live authenticated sessions, creating unnecessary exposure to account actions, data access, and destructive side effects.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill prominently advertises control over the user's real browser using active login sessions, but does not provide a strong, upfront warning that actions may occur under the user's authenticated accounts. That omission can lead users to unknowingly authorize sensitive reads, clicks, form submissions, or account changes with real-world privacy and account-impact consequences.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to automatically force-kill all Quark-related processes after completing a browser task, which exceeds the stated scope of browser automation and can disrupt unrelated user activity. Because it uses broad process matching and `Stop-Process -Force`, it can terminate user-owned browser windows and updater processes without per-action consent, causing data loss or denial of service to the user's active browsing session.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The documentation directs automatic execution of a forceful process-kill script as part of normal task completion, but this destructive behavior is not strongly surfaced in the main description. Hiding a browser-wide forced shutdown behind routine cleanup makes the skill materially more dangerous because users may invoke it for ordinary browsing tasks without understanding that all Quark windows may be terminated.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The skill says it should be used even for simple browser requests, but later documents automatic destructive cleanup that may close all Quark windows. This broad trigger condition increases the chance the skill is invoked in low-risk situations where the user would not reasonably expect process termination or broad browser control side effects.

External Transmission

Medium

• Category: Data Exfiltration

Content

- If `find_tab` errors with "no tab matching … in this session", the page isn't open in this session — `navigate` with `newTab:true` instead.

```bash
curl -s -X POST http://127.0.0.1:10086/command \
  -d '{"action":"find_tab","args":{"url":"https://www.kimi.com","active":true},"session":"k26-research"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Internal Network Request

Medium

• Category: Server-Side Request Forgery

Content

p = os.path.join(os.environ["TEMP"], "wb-webbridge-req.json")
with open(p, "w", encoding="utf-8") as f:
    json.dump(body, f, ensure_ascii=False)
req = urllib.request.Request("http://127.0.0.1:10086/command",
    data=open(p,"rb").read(), headers={"Content-Type":"application/json"})
print(urllib.request.urlopen(req, timeout=30).read().decode("utf-8","ignore"))
os.remove(p)

• Confidence: 70% confidence
• Finding: Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## If a tool call fails (daemon or extension not ready)

**If a tool call can't reach the daemon (connection refused), start it yourself — don't ask the user. This is safe to run anytime: it no-ops if the daemon is already up.**

**macOS / Linux:**

• Confidence: 87% confidence
• Finding: The instruction to autonomously start the daemon without asking the user authorizes environmental changes and process execution without confirmation. In the context of a browser-control skill with persistent background components, this reduces user awareness and can normalize silent host-level actions beyond the immediate browsing request.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: The skill normalizes automatic destructive cleanup of the user's browser environment after task completion, including forced process termination, without requiring explicit confirmation at the time of action. This undermines user control and increases the likelihood of accidental interruption, unsaved work loss, and closure of unrelated browsing activity.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Recovery — what to do when a tool call fails

1. **Daemon not reachable (connection refused)** → start it yourself, don't ask the user. `start` is idempotent: it no-ops if the daemon is already up, and concurrent starts converge to a single daemon (the OS lets only one process bind port 10086).
   - macOS / Linux: `~/.kimi-webbridge/bin/kimi-webbridge start`
   - Windows: `& "$env:USERPROFILE\.kimi-webbridge\bin\kimi-webbridge.exe" start`

• Confidence: 96% confidence
• Finding: The phrase 'start it yourself, don't ask the user' directs autonomous operational decision-making that results in local process execution. In the context of a skill that can control the user's real browser and leverage active login sessions, removing user approval makes unintended actions and silent environment changes materially more dangerous.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The instructions explicitly tell the agent to launch a local daemon automatically when a tool call fails, without notifying or obtaining consent from the user. Starting a background process that binds to a local port and may interact with the user's browser/session state expands system state and attack surface without transparency, which is especially risky for a browser-control skill operating with real login sessions.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The instructions specify only two locale variants for the help page, English and Chinese, which can impose a language choice without stating that the user should be asked or allowed to pick their preferred language. This can conflict with language/locale policy expectations when no opt-in or preference check is described.

Static analysis

No suspicious patterns detected.