Security audit

Browser Use

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed browser automation skill with scraping and clicking guidance, but no hidden install behavior, persistence, credential capture, or destructive instructions were found.

Install only if you want an agent to control a browser for browsing, clicking, scrolling, screenshots, and page-data extraction. Avoid using it for sensitive, authenticated, personal, or large-scale scraping unless you have permission and understand the site rules; review tasks carefully before allowing broad data collection.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The activation criteria are broad enough to trigger on many generic browsing or information-gathering requests, which can cause this powerful browser automation skill to be selected when a narrower or safer skill would suffice. In context, the skill enables navigation, clicking, scraping, and scripted extraction, so over-activation increases the chance of unintended web interaction, data collection, or policy-sensitive automation.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill explicitly supports web scraping, batch extraction, and repeated pagination, but it provides no user-facing guardrails about sensitive data, privacy expectations, robots/terms restrictions, or consent boundaries. That omission makes it easier for the agent to collect personal, proprietary, or policy-restricted content at scale without surfacing the compliance or privacy risks to the user.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: Most operational instructions, headings, and examples are presented in Chinese, which effectively imposes a language preference on users and maintainers without opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option, so this is a natural-language locale policy concern.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The document title and content enforce Chinese-language operating instructions without presenting a language choice or opt-in. In a browser automation skill, forcing a language can cause the agent or operator to misunderstand page state, pagination controls, or safety-relevant instructions, increasing the chance of incorrect automation behavior and failed oversight.

Static analysis

No suspicious patterns detected.