Security checks for vulnerabilities and agentic risk
Overview
This browser automation skill is mostly purpose-aligned, but it exposes powerful page-script execution and unrestricted screenshot file writes that need review before installation.
Install only if you trust agents using it to control a browser session. Avoid using it on sensitive logged-in sites unless you explicitly need that access, and prefer restricting or removing execute_script and confining screenshot output to a dedicated workspace directory before broad use.
The public screenshot API accepts a caller-controlled output path. The implementation resolves that path and creates its parent directories without validating that the destination remains inside an authorized workspace.
Absolute paths and relative traversal sequences such as ../ can therefore address any filesystem location writable by the Agent process. The screenshot operation does not reject an existing destination, so it can overwrite an existing file with PNG data. Resolving the path does not provide confinement; it only converts the supplied path into an absolute path.
The issue is limited by the operating-system permissions of the process. Nevertheless, no application-level restriction prevents modification of writable workspace files, user configuration, cached data, or other process-accessible files.
Attack Path
An attacker controls or influences a task, argument, or untrusted page instruction presented to the Agent.
The attacker causes the Agent to invoke the public API with a sensitive writable destination, for example:
python
A traversal-based relative path could also be used.
Path(output).resolve() accepts and normalizes the attacker-selected destination.
mkdir(parents=True, exist_ok=True) creates missing parent dir
...[truncated 871 chars]
Remediation
View remediation
Remediation Suggestions
Constrain screenshot output to a dedicated directory under the authorized workspace:
Reject absolute paths and traversal components such as ...
Resolve both the trusted output root and requested destination, then verify that the destination is contained within the trusted root using Path.is_relative_to() or an equivalent robust check.
Account for symbolic links by rejecting symlink path components or securely opening files relative to a trusted directory.
Do not overwrite existing files by default. Use exclusive creation and require explicit authorization for replacement.
Use generated filenames when the caller does not need to select one.
Apply restrictive permissions to the screenshot directory and created files.
Return an error when a requested destination violates the output policy.
Example containment logic:
python
workspace = Path(os.environ.get("workspace_dir", "/tmp")).resolve()
screenshot_root = (workspace / "screenshots").resolve()
screenshot_root.mkdir(parents=True, exist_ok=True)
requested = Path(output)
if requested.is_absolute() or ".." in requested.parts:
raise ValueError("Screenshot output must be a workspace-relative path")
destination = (screenshot_root / requested).resolve()
if not destination.is_relative_to(screenshot_root):
raise ValueError("Screenshot output escapes the authorized directory")
if destination.exists():
raise FileExistsError("Refusing to overwrite an existing file")
Where supported, use directory-relative, no-follow, and exclusive file-opening primitives to reduce symlink race risks.
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Context-Inappropriate Capability
High
Category
Not specified by scanner
Confidence
96% confidence
Finding
Arbitrary page-script execution is unjustified for the stated assistant purpose and materially expands the attack surface of the skill. In this browser-automation context, the capability is especially dangerous because it operates inside live pages that may contain session-authenticated content, allowing stealthy data access or action execution not visible through the normal element-based API.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
High
Category
Not specified by scanner
Confidence
97% confidence
Finding
The skill exposes a public execute_script() API that accepts arbitrary JavaScript and runs it in the active page context, which goes beyond the declared browsing, search, scraping, and form-interaction scope. This enables an agent or downstream caller to perform unrestricted DOM manipulation, extract hidden page data, trigger privileged in-page actions, or bypass intended workflow constraints on any authenticated site the browser has access to.
Content
No source excerpt is available for this finding.
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill exposes capabilities implying environment access, file read/write, and network use, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, this weakens least-privilege controls and can enable broader-than-expected access to local data, secrets, or arbitrary web resources if the skill is invoked inappropriately.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The natural-language description and usage guidance are entirely presented in Chinese and the examples assume Chinese search terms and Chinese sites, which indicates a fixed language/locale expectation. The file does not offer any opt-in or alternative language behavior, so this constitutes a language/locale policy concern under the stated rules.
The file’s natural-language documentation and user-facing messages are written exclusively in Chinese, effectively imposing a specific language/locale on users of the skill. The policy allows locale constraints only when justified or when users are offered a choice, neither of which is present here.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The screenshot API writes a PNG to an arbitrary caller-supplied path and creates parent directories, but there is no confirmation prompt, explicit user-facing warning before the write, or nearby comment/docstring disclosing this filesystem side effect. For a code file, file writes should have some visible disclosure unless clearly covered by the skill description, which this file does not provide.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Low
Category
Not specified by scanner
Confidence
91% confidence
Finding
The top-level documentation explicitly says 'Browser Skill - Playwright 浏览器自动化', which conflicts with the manifest's stated implementation basis of '通过 nodriver 驱动浏览器'. This is an intent/documentation contradiction rather than a mere omission, because it names a different browser automation stack.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
91% confidence
Finding
The module docstring presents its title and usage guidance in Chinese only, with no indication that users can choose another language. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without explicit opt-in or documented justification.
