Smooth Browser

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:12 AM UTC
• Version: 0.1.0

Overview

This browser automation skill is coherent, but it gives agents broad web, account-session, file-upload, and persistent-profile authority without enough scoping or consent guidance.

Review before installing. Use this only for deliberate browser automation, prefer anonymous or read-only profiles when possible, restrict sessions with allowed URL patterns, avoid uploading sensitive files unless necessary, and require explicit confirmation before logins, account changes, purchases, public posting, or reusing saved authenticated profiles.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

bash

pip install smooth-py

Technical Analysis

The skill instructs users or agents to install smooth-py from the configured Python package index without specifying a reviewed version or verifying an artifact hash. As a result, the package and its transitive dependencies remain mutable after the skill has been audited.

Python package installation can execute package-controlled build or installation logic. If the package publisher, one of its dependencies, or the configured package index is compromised, following this instruction could cause attacker-controlled code to run locally. The reviewed material does not establish that smooth-py is currently malicious; the finding concerns the unsafe, unpinned supply-chain installation method.

Attack Path

1. An agent loads the skill and discovers that Smooth CLI is not installed.
2. The agent or user follows the documented pip install smooth-py instruction.
3. pip resolves the current package release and its transitive dependencies from the configured index.
4. A compromised or malicious release supplies attacker-controlled package content or installation logic.
5. That logic executes with the privileges of the account running pip.
6. The installed code can subsequently run whenever the documented Smooth commands are invoked.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's privileges. The attacker could access files, environment variables, credentials, browser-related data, and network resources available to that account. If installation is performed by a privileged account or in a sensitive shared environment, the scope could expand accordingly. No privilege escalation beyond the installer's existing permissions is demonstrated by the reviewed fi ...[truncated 3 chars]

Remediation

View remediation

Remediation Suggestions

• Pin smooth-py to an explicitly reviewed version rather than installing the latest available release.
• Use a lock file or constraints file to pin all transitive dependencies.
• Require artifact hashes, such as with pip install --require-hashes -r requirements.txt.
• Document and enforce the expected official package index and verified publisher.
• Install the dependency in an isolated, least-privileged virtual environment.
• Integrate dependency vulnerability and provenance checks into the release process.
• Review and deliberately approve dependency updates before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases and description are extremely broad, effectively matching almost any web-related request such as logging in, scraping, filling forms, testing sites, or general browser interaction. This can cause unintended invocation of a high-capability browser automation skill in contexts where the user did not explicitly consent, increasing the risk of acting on sensitive sites, submitting data, or exfiltrating web content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill promotes authentication, scraping, file upload, persistent profiles, and session reuse, but does not prominently warn that credentials, cookies, uploaded files, and page data may be transferred to an external service and persisted across sessions. In this context, the missing warnings are material because the skill is designed to handle highly sensitive browser state and user data, making accidental disclosure or over-collection more likely.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction to save in memory which profiles authenticate to which services creates a durable mapping between user identities/accounts and reusable authenticated browser state. In an agent setting, that increases the risk of cross-task leakage, misuse of the wrong account, or unintended access to services using previously stored associations and persistent session artifacts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.