Security audit

Browser Fetch

Security checks for vulnerabilities and agentic risk

Overview

This browser-fetch skill does what it says, but it gives agents a powerful unsandboxed browser that can reach arbitrary network locations and may expose proxy credentials in output.

Use this only in a tightly isolated environment with no access to localhost services, private networks, cloud metadata, or sensitive mounted files. Avoid ambient authenticated proxy variables unless output is controlled, and review any --output or --metadata path before running it. This needs maintainer fixes before routine installation in a privileged or network-trusted agent environment.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: browser-fetch.mjs:169
Finding: Unrestricted Browser Navigation Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: browser-fetch.mjs:280
Finding: Chromium Sandbox Is Unconditionally Disabled for Untrusted Web Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: browser-fetch.mjs:167
Finding: Proxy Credentials May Be Disclosed Through Metadata Output
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill exposes network access and can inherit proxy-related environment variables, but it declares no explicit tool scope or permission boundary. That creates an authorization and review gap: downstream agents or operators may not realize the skill can make external requests and consume ambient environment configuration, which can lead to unintended data egress or misuse of privileged network paths.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code fetches arbitrary URLs via Playwright and may persist results through --output or --metadata, but the executable flow contains no confirmation prompt, user-facing notice, or inline warning comment/docstring about these potentially privacy- or data-affecting actions. For a code file, network transmission and file writes are safety-relevant operations that should have some explicit disclosure unless already clearly warned elsewhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The documented --output PATH and --metadata PATH options allow writing files locally, but the skill provides no warning about overwriting existing files or modifying the local workspace. In an agent setting, that omission can contribute to accidental clobbering of important files or writing attacker-influenced content to sensitive locations if paths are not carefully controlled.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.