Security audit

Browser Automation

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is coherent, but it needs review because it can act on authenticated sites, persist sessions and downloads, and use an external AI service without a per-use prompt.

Install only if you are comfortable giving an agent browser-control authority. Use test accounts or an isolated browser profile, avoid sensitive/internal sites unless approved for external processing, review any action before submitting forms or logging in, and clean up .chrome-profile, screenshots, and downloads after use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
### First: Environment Selection (Local vs Remote) The skill automatically selects between local and remote browser environments: - **If SKILLBOSS_API_KEY exists** (SKILLBOSS_API_KEY in .env file): Uses SkillBoss API Hub remote mode - **If no SKILLBOSS_API_KEY**: Falls back to local Chrome browser - **No user prompting**: The selection happens automatically based on available configuration

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup.json (reported line 17)May include surrounding context.
json
### First: Environment Selection (Local vs Remote) The skill automatically selects between local and remote browser environments: - **If SKILLBOSS_API_KEY exists** (SKILLBOSS_API_KEY in .env file): Uses SkillBoss API Hub remote mode - **If no SKILLBOSS_API_KEY**: Falls back to local Chrome browser - **No user prompting**: The selection happens automatically based on available configuration

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup.json (reported line 29)May include surrounding context.
json
### First: Environment Selection (Local vs Remote) The skill automatically selects between local and remote browser environments: - **If SKILLBOSS_API_KEY exists** (SKILLBOSS_API_KEY in .env file): Uses SkillBoss API Hub remote mode - **If no SKILLBOSS_API_KEY**: Falls back to local Chrome browser - **No user prompting**: The selection happens automatically based on available configuration

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
For API reference, see [REFERENCE.md](REFERENCE.md).

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The login example normalizes entering credentials into a browser automation flow and explicitly notes reuse of Chrome user-profile state, which can preserve session cookies across runs. In an agent setting, this increases the chance of credential exposure, unintended authenticated actions, and cross-task session leakage if users are not clearly warned about privacy, persistence, and account-impact risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation states that page.act() uses an external AI service but does not clearly warn users that page content, DOM context, or potentially sensitive on-page data may be transmitted off-host for action resolution. In a browser automation skill, this is dangerous because users may perform actions on authenticated, internal, or sensitive pages without understanding that external processing could expose confidential data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The extract command explicitly uses an external AI-backed extraction flow yet lacks a clear disclosure that extracted page data and surrounding content may be transmitted to a third-party service. This is particularly risky because extraction is often used on structured business, personal, or internal data, increasing the chance of unintentional data exfiltration.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The configuration explicitly routes model operations through https://api.heybossai.com/v1/pilot, confirming that browser automation decisions may depend on an external network service. While not inherently malicious, this is security-relevant because page content from local, authenticated, or internal sites could be transmitted to that external endpoint during AI-assisted actions or analysis.
Content: Scanner excerpt · REFERENCE.md (reported line 347)May include surrounding context.
md
env: "LOCAL", verbose: 0, enableCaching: true, model: "skillboss/auto", // routed via SkillBoss API Hub (https://api.heybossai.com/v1/pilot) localBrowserLaunchOptions: { cdpUrl: wsUrl, },

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The reference documents automatic download behavior that silently writes files to ./agent/downloads/ with no prominent warning in the command descriptions about unattended disk writes. In a browser automation context, this can lead to unexpected storage of untrusted or malicious files, including content downloaded from compromised pages or internal workflows.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The version information reiterates use of an externally routed SkillBoss API Hub for browser actions, which reinforces that this skill depends on third-party network processing. In this skill context, that increases risk because the browser can access localhost, internal networks, cookies, and authenticated sessions, making external transmission more sensitive than in a generic web-browsing tool.
Content: Scanner excerpt · REFERENCE.md (reported line 530)May include surrounding context.
md
## Version Information - **Stagehand**: Uses `@browserbasehq/stagehand` package v2.5.2+ - **Model**: SkillBoss API Hub (auto-routed via https://api.heybossai.com/v1/pilot) for browser actions - **CLI Tool**: TypeScript CLI in `src/cli.ts` - **Agent SDK**: SkillBoss API Hub SDK for conversation framework - **Browser**: Local Chrome/Chromium installation

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill description is broad enough to activate for many ordinary web-related requests, including actions that can navigate to arbitrary sites and perform state-changing interactions. In a browser-automation skill, over-broad triggering increases the chance the agent will invoke powerful web capabilities without clearly scoped user consent or guardrails.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description does not warn that browser actions may click buttons, fill forms, and submit data to external websites, which can transmit user or system-provided information off-box. Because the skill is designed for interactive web automation, omission of this warning makes accidental exfiltration or unintended state changes more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill automatically chooses a remote browser service when an API key is present, without user prompting or disclosure at decision time. That means browsing activity, page contents, and possibly entered data may be routed through an external provider unexpectedly, increasing privacy, compliance, and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The download example instructs navigation to a file URL and notes that files are automatically written to ./agent/downloads/, but it does not clearly warn that local storage will be modified. In an automation context, silent writes can surprise users, consume disk space, or persist potentially sensitive or untrusted content on the host.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.