SmoothBrowser

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:18 AM UTC
• Version: 1.0.0

Overview

This is a coherent browser automation skill, but it deserves review because it can operate inside logged-in web sessions, persist cookies, upload files, and act broadly on websites without strong built-in scoping or consent guidance.

Install and use this only if you trust Smooth CLI and are comfortable sending browser tasks, uploaded files, and session activity through that service. Prefer an isolated environment, verify or pin the package version, use `--allowed-urls` and `--profile-read-only` where possible, avoid broad authenticated actions without supervision, and delete profiles/files when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15
Vulnerability Type: Insecure dependency installation
Risk Level: Medium

Vulnerable Code

bash

pip install smooth-py

Technical Analysis

The installation instruction retrieves the latest available release of smooth-py from the configured Python package index without an exact version constraint, cryptographic hash verification, lockfile, or reference to a reviewed artifact.

Because Python packages can execute package-controlled build or installation logic, the effective code installed by this command may change after the Skill has been audited. A compromised maintainer account, package repository compromise, or malicious future release could therefore turn this documented installation step into arbitrary local code execution.

The audit found no evidence that the currently named package is malicious. The finding concerns the unsafe, non-reproducible dependency installation method.

Attack Path

1. An attacker compromises the package publisher, publishing process, or package repository and releases a malicious version of smooth-py.
2. A user follows the prerequisite instructions and runs pip install smooth-py.
3. pip resolves the unpinned dependency to the attacker-controlled release.
4. Malicious package logic executes during installation, build processing, import, or subsequent CLI invocation.
5. The payload operates with the privileges of the user running pip or the installed CLI.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's permissions and environment, the attacker could access local files, environment variables, API credentials, browser profiles, authenticated session data, and network resources available to the user. System-wide installation with elevated privileges would increase the potential scope.

No evidence of persistence, embedded malicious code, s ...[truncated 77 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version, for example:

   bash

   python -m pip install "smooth-py==<reviewed-version>"
   

2. Distribute a requirements or lock file containing cryptographic hashes, and install with hash enforcement:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Verify the package's official publisher, source repository, release signatures, and provenance before recommending installation.

4. Prefer installation in an isolated virtual environment with the minimum required operating-system privileges.

5. Establish an update-review process so dependency versions and hashes are changed only after security review.

6. Avoid privileged or system-wide installation unless it is strictly necessary.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger phrase guidance is extremely broad, including generic phrases like 'scrape', 'automate', 'test the website', 'log into', or essentially any browser interaction request. That can cause the browser skill to be invoked for sensitive or unintended tasks, increasing the chance of credential handling, data exfiltration, or autonomous web actions without sufficient user confirmation. In this context, the skill is powerful and can authenticate, persist sessions, upload files, and execute JS, which makes over-triggering materially more dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill encourages persistent profiles, cookies, login reuse, file uploads/downloads, and live authenticated sessions, but it does not pair those capabilities with explicit privacy, consent, retention, and sensitive-data handling warnings. Users or upstream agents may therefore store credentials/session state or transfer sensitive files without understanding persistence or exposure risks. The danger is elevated here because the skill is specifically designed for authentication and long-lived browser state.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction to 'save to memory which profiles authenticate to which services' creates a natural-language retention map of account identities and authenticated browser profiles. Even without storing raw secrets, that mapping is sensitive operational metadata that can enable account targeting, unauthorized reuse of sessions, or privacy violations if retained broadly or surfaced to other tasks. The risk is amplified because the skill supports persistent authenticated sessions across websites.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.