My Browser Agent

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:05 AM UTC
• Version: 1.0.0

Overview

This browser automation skill does what it claims, but it gives broad URL-visiting and screenshot capability without enough scoping or cleanup controls.

Review before installing. Use this only in an environment where broad browser egress is acceptable, avoid sending it internal, localhost, metadata-service, authenticated, or sensitive URLs, and treat generated screenshots as sensitive because they are written to a predictable shared /tmp path and not cleaned up.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:3

Finding

Unrestricted Browser Navigation Enables Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:23

Finding

Predictable Shared Screenshot Path Creates File-Race and Cross-Request Disclosure Risks

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description advertises visiting any URL and taking screenshots without warning about the risks of arbitrary web navigation, including exposure to phishing pages, internal endpoints, sensitive authenticated content, or data captured in screenshots. Without user-facing warnings and operational safeguards, users and calling agents may treat the capability as routine and invoke it in unsafe contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill can be invoked with very broad language to visit arbitrary URLs and perform browser actions, but it does not define clear trigger constraints, scope limits, or approval boundaries. In an agent environment, this increases the chance of unintended activation and unsafe navigation to attacker-controlled sites, which can expose session data, sensitive page content, or trigger risky downstream actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill launches a real browser and navigates to a fully user-controlled URL with no validation, allowlist, or warning about outbound network access. This creates an SSRF-style capability through browser automation, which can be abused to reach internal services, cloud metadata endpoints, or other sensitive network locations from the environment where the skill runs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The inline comment contains Chinese text ('生产环境建议 headless: true'), introducing a language-specific instruction in a file that otherwise uses English. This can violate language/locale policy when a specific language is imposed without offering user choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency uses a caret version range ("^1.58.2") rather than an exact pinned version, which allows newer compatible releases to be installed over time. This creates a supply-chain risk because builds may become non-reproducible and could silently pick up a compromised or breaking upstream release.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"author": "",
  "license": "ISC",
  "dependencies": {
    "playwright": "^1.58.2"
  }
}