browser-exploitation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to extract cookies, tokens, and saved passwords and to record/return them (via add_credential() and the final summary), which requires the LLM to include secret values verbatim in its output.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document instructs clear, intentional malicious activity — extension-based cookie/credential theft and exfiltration (HTTP/DNS/WS/beacon), guidance for reverse shells, Chrome DevTools/Node inspector remote code execution, and systematic browser profile/password extraction — constituting high-risk, deliberate abuse and backdoor behaviors.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill performs runtime calls to browser/Node debug endpoints (e.g., http://TARGET:9222/json and http://TARGET:9229/json and the returned webSocketDebuggerUrl like ws://... ) and then sends Runtime.evaluate / exec commands over the WebSocket to execute code on the remote target, so these URLs are runtime dependencies that enable remote code execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs executing OS commands via CDP/Node inspector and extension-delivered reverse shells, reading and copying sensitive local files, and saving exfiltrated data to local paths—actions that enable remote code execution, data exfiltration, and writing to the host, which clearly compromise the machine's state.