Security audit

Browser Automation

Security checks across malware telemetry and agentic risk

Overview

This is a coherent browser automation skill, but it needs Review because it can automatically route browsing through a remote service, reuse persistent logged-in browser state, download files locally, and asks users to install code that is not included in the reviewed artifact.

Install only after you can verify the missing CLI implementation and you are comfortable with SkillBoss API Hub handling browser tasks. Prefer an isolated or disposable browser profile, avoid real credentials unless explicitly needed, confirm before submitting forms or downloading files, and regularly clear .chrome-profile, screenshots, and downloads.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The examples instruct an agent to fill and submit a contact form and, separately, to enter login credentials without any cautionary language about consent, data sensitivity, or irreversible external side effects. In a browser-automation skill, examples strongly shape agent behavior, so omission of warnings can normalize actions that send user data to third-party sites or change account state without explicit confirmation.

Missing User Warnings

High

Confidence: 97% confidence
Finding: This login example combines credential entry with a note that Chrome's user profile may preserve session cookies between runs, which increases the chance of credential leakage, unintended account reuse, and cross-task session persistence. In an agent setting, persistent profiles can cause later tasks to inherit authenticated state, enabling accidental access to sensitive accounts or actions on behalf of a prior user.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The download example causes a file to be written to a local directory but only mentions the destination in a note, not as a clear safety warning about local side effects or trust of downloaded content. In a browser automation context, examples that normalize silent downloads can lead to storage abuse, accidental handling of untrusted files, or downstream execution/opening of malicious content by users or later workflows.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The reference explicitly documents automatic downloads to a local directory without a prominent user-facing warning or consent step. In a browser automation skill, silent file writes can lead to unexpected storage of untrusted content, including executables, documents, or sensitive data, which increases risk of malware staging and accidental data retention.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill states that natural-language actions are processed via the SkillBoss API Hub, but the reference does not clearly warn users that prompts and potentially page context may be transmitted to an external service. Because browser automation may involve credentials, internal URLs, or sensitive page content, this creates a real privacy and data exposure risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Structured extraction is described as using an external AI service to analyze page content, but users are not prominently warned that extracted or surrounding page data may leave the local environment. This is especially risky for pages containing personal data, business information, or authenticated application content.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill description is broad enough to match many ordinary browsing or web-help requests, which increases the chance the agent will invoke this skill in situations where browser automation is unnecessary or unsafe. Because the skill can navigate, extract data, fill forms, and interact with web applications, overbroad triggering expands the attack surface for prompt-injection, unintended data access, and risky web actions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill silently switches between local Chrome and a remote SkillBoss environment based on whether an API key is present, without warning the user that browsing activity and page data may execute in a different privacy and trust context. This can cause sensitive content, session state, or user-entered data to be processed remotely when the user expected local execution.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.