Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local browser-control helper, but users should treat it as powerful because it can act inside an attached Chrome tab.
Install only if you intentionally want an agent to control an attached Chrome tab. Attach non-sensitive tabs when possible, avoid using it on banking, admin, or private account pages unless you explicitly need that, and treat the relay token like a password that grants browser-control access.
scripts/ctl.js:143JavaScript Injection Through Click and Fill Arguments
scripts/ctl.js:121Arbitrary File Overwrite Through Screenshot Output Path
The skill requires sensitive environment-backed secrets (RELAY_TOKEN, RELAY_PORT) but does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege boundaries and makes the skill's effective capabilities less visible to reviewers and users, increasing the chance of unintended secret access or unsafe invocation.
The trigger conditions are broad enough to match normal browser-assistance requests, causing the skill to activate in situations where direct browser control may not be necessary. In this skill's context, activation grants the ability to operate a live attached Chrome tab, so over-triggering increases the risk of unintended navigation, clicks, form entry, or script execution in the user's active session.
The description does not clearly warn users that the skill can control an already attached Chrome tab in their live browser session, including actions like navigation, clicking, screenshots, and JavaScript evaluation. Because this operates in the user's authenticated browsing context, insufficient disclosure can lead to high-impact unintended actions affecting privacy, accounts, or sensitive data.
The script reads a relay token from a local secrets file in the user's home directory and uses it to authenticate to a browser relay service. Even if this is intended for local browser control, it is still credential access and expands the skill's privilege beyond simple browser automation; a compromised or repurposed skill could silently reuse that token to control the user's attached Chrome tab.
The code accesses a relay token from a local secrets file without any user-facing notice in the tool itself that credentials are being consumed. In a skill ecosystem, undisclosed credential use is risky because users may believe they are granting only browser-control actions, while the skill is also retrieving an authentication secret that can be abused for persistent access to the relay.
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
console.log(' url - Get current URL');
console.log(' evaluate <js> - Execute JS');
console.log(' click <selector> - Click element');
console.log(' fill <selector> <text> - Fill input');
process.exit(1);
}
The skill exposes powerful browser actions including arbitrary JavaScript execution via Runtime.evaluate, DOM clicking, and form filling against an already attached user tab. In this context, that is especially dangerous because it operates on the user's live authenticated browser session, enabling account actions, data extraction, or transaction abuse if invoked unsafely or by a malicious higher-level prompt.
All user-facing natural-language instructions in the file are in Chinese, with no indication that the user can choose another language. This may violate language/locale policy where skills should not force a specific language without user opt-in or clear justification.