Back to skill

Security audit

Browser MCP Agent

Security checks across malware telemetry and agentic risk

Overview

The skill is a high-capability browser-control integration, but its persistent profiles, JavaScript execution, live view, external binary, and API-key use are clearly disclosed and aligned with its stated purpose.

Install only if you are comfortable giving an agent a real logged-in browser. Use pinned package versions, review the vendor binary risk, keep the API key in environment variables, expose only the MCP tools needed for the task, use separate or throwaway profiles for untrusted sites, avoid live view on sensitive accounts, and require human approval before actions that spend money, delete data, or post publicly.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
- Dashboard: `https://antibrow.com`
- Full SDK / REST API reference: see the `anti-detect-browser` skill

> **Authorized use only.** Point this at sites and accounts you own or are permitted to operate: your own apps, your own accounts, publicly available pages, your own bot detection under test. Do not use it to reach systems without authorization, to log into accounts that are not yours, to create fake accounts or engagement, or to work around a platform's enforcement decision. Respect each site's terms, `robots.txt` and rate limits - see [Acceptable use](#acceptable-use).

**This gives an agent real capability, so scope it deliberately.** The server hands the model a browser that persists logins, executes JavaScript in the page, and can stream its screen to a shareable URL. That is the point of the tool and also its blast radius: an agent that goes wrong here goes wrong inside a logged-in session. Run untrusted browsing in a throwaway profile, keep tools you do not need out of the toolset, and read [Everything the browser returns is untrusted input](#everything-the-browser-returns-is-untrusted-input) before pointing it at the open web.
Confidence
60% confidence
Finding
create fake accounts or engagement, or to work around a platform's enforcement decision. Respect each site's terms, `robots.txt` and rate limits - see [Acceptable use](#acceptable-use). **This gives

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.