Why this verdict
- suspicious: finding skill:container/skills/agent-browser:container/skills/agent-browser/SKILL.md:159:CRED
- suspicious: finding skill:container/skills/agent-browser:container/skills/agent-browser/SKILL.md:3:SUPPLY
Security findings 2
Credential access
highContextual risklow confidenceThe skill instructs the agent that it can run `agent-browser cookies` and `agent-browser storage` to dump all cookies and localStorage of the automated browser session, a credential-bearing capability not covered by the declared browse/read/fill/screenshot purpose and flagged as undeclared residue by detectors.
# Get all cookies
vector:instruction
Counter-argument considered
The strongest defense (cookie inspection is standard for 'test web pages') fails: the full-file claim scan shows the only declared claim is the wait-loop safety rule, and the declared description covers browsing/form/screenshot/data-extraction, not credential-jar access; the section directly instructs running cookie/localStorage dump commands and no carve-out applies.
Supply chain
mediumContextual riskmedium confidenceThe skill pre-authorizes Bash execution via allowed-tools: Bash(agent-browser:*) and instructs the agent to run an agent-browser CLI (including cookies, storage, state save/load of auth state, and arbitrary JavaScript eval) for every operation, but the artifact ships no such executable, so at runtime the agent executes whatever unreviewable binary answers to that name with pre-granted permission to harvest cookies and saved authentication state.
allowed-tools: Bash(agent-browser:*)
vector:instruction
Counter-argument considered
The served lines 26-129 plus the remaining units show the entire SKILL.md, and it contains no install command, pinned registry reference, or bundled script path for agent-browser, so the wildcard pre-authorization in the frontmatter resolves at runtime to whatever binary answers to that name. The body then routes cookies, localStorage, auth-state save/load, and arbitrary JS eval through that unprovisioned name with no declared provenance and no carve-out (this is not a pinned official-registry install and not broad permissions alone, since concrete instructions direct credential-touching operations through it), so the finding survives all four gates.
Coverage gaps 2
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
.claude/skills/add-clidash/add/tools/clidash/public/favicon.ico
context:unanalyzable_binary binary content is only byte-scanned
src/drivers/docker-driver.ts
