Security Audit
Mytai20100/opencode-browser:root
github.com/Mytai20100/opencode-browserTrust Assessment
Mytai20100/opencode-browser:root received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 7 findings: 4 critical, 0 high, 2 medium, and 1 low severity. Key findings include Persistence / self-modification instructions, Arbitrary command execution, Missing required field: name.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 10/100, indicating areas for improvement.
Last analyzed on August 30, 2026 (commit 0acacf79). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings7
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Persistence / self-modification instructions Shell RC file modification for persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles. | Manifest | extension/background.js:2216 | |
| CRITICAL | Arbitrary command execution Python dynamic code execution (exec/eval/compile) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | extension/background.js:495 | |
| CRITICAL | Arbitrary command execution Python dynamic code execution (exec/eval/compile) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | extension/background.js:1355 | |
| CRITICAL | Unauthenticated WebSocket Server Exposed on 0.0.0.0 with No Origin Validation The MCP WebSocket server binds to '0.0.0.0' (all interfaces) and accepts all connections ('verifyClient: () => true') without any authentication or Origin header validation. This allows any device on the local network, or any malicious website visited by the user (via a Cross-Origin WebSocket connection to localhost), to connect to the server. Because the server broadcasts commands to all connected clients, a malicious connection can intercept sensitive browser automation commands (including cookies, credentials, and page content) and spoof tool execution results. 1. Bind the WebSocket server to '127.0.0.1' by default instead of '0.0.0.0' to prevent local network exposure. 2. Implement Origin validation in 'verifyClient' to reject connections from web browsers (e.g., only allow connections from the specific Chrome extension ID or block non-extension origins). 3. Implement a shared secret/token authentication mechanism between the extension and the server. | LLM | server/index.ts:10 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | SKILL.md:1 | |
| MEDIUM | Unpinned npm dependency version Dependency '@modelcontextprotocol/sdk' is not pinned to an exact version ('^1.29.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | server/package.json | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | server/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/4f887170fbf25a61)
Powered by SkillShield