BrowserOS CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:39 AM UTC
• Version: 1.0.0

Overview

The skill is transparent about controlling a real browser, but it uses an unpinned browser-control CLI install path and exposes persistent browser changes without enough confirmation guidance.

Install only if you trust the BrowserOS CLI source and are comfortable with an agent controlling a real browser. Prefer a pinned, reviewed CLI version, avoid unpinned npx, use an isolated browser profile where possible, and require explicit approval before form submission, uploads/downloads, history or bookmark changes, and closing existing tabs or windows.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Global Installation of a Third-Party CLI Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 31
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable code:

bash

# If not installed:
npm install -g browseros-cli

Technical Analysis

The setup instructions direct the agent to install browseros-cli globally from the npm registry without specifying an exact version or validating package integrity. Consequently, the code installed when the Skill runs can differ from the code that existed when the Skill was audited.

npm packages may execute lifecycle scripts during installation. If the package, one of its transitive dependencies, its maintainer account, or the registry distribution channel is compromised, attacker-controlled installation scripts could execute with the operating-system privileges of the user running the agent. The global installation also modifies the user's executable environment rather than confining the dependency to the project.

This is a supply-chain risk rather than evidence that the current browseros-cli package is malicious. The instruction is relevant to the Skill's functionality when the CLI is absent, but global, unpinned installation exceeds the minimum privilege needed to document or invoke an already trusted CLI.

Attack Path

1. An attacker compromises the npm package, a dependency, a maintainer account, or a newly published package version.
2. The compromised version is published under the browseros-cli package name.
3. An agent follows the Skill's setup instructions on a system where the CLI is unavailable.
4. npm install -g browseros-cli resolves and downloads the attacker-controlled version because no exact version or integrity digest is specified.
5. Malicious npm lifecycle code executes during installation, or a malicious CLI executable is placed in the user's global executable path.
6. The payload can access data and perform actions permitted to the i ...[truncated 878 chars]

Remediation

View remediation

Remediation Suggestions

• Do not automatically install dependencies as part of normal Skill execution. Require the user or administrator to provision and approve the CLI separately.
• Pin the package to a reviewed exact version, for example browseros-cli@X.Y.Z, rather than resolving the latest release.
• Verify package provenance and integrity before installation. Maintain an approved package-lock file or an equivalent artifact containing integrity hashes.
• Prefer a project-local, isolated installation over npm install -g, and run it from a restricted environment with no unnecessary access to credentials or sensitive files.
• Disable lifecycle scripts during installation where compatible with the package, such as with npm install --ignore-scripts, and separately review any setup steps that are actually required.
• Use an organization-controlled registry mirror or allowlist and monitor package ownership, release signatures, and dependency changes.
• Document a minimum supported version and reject unexpected versions after installation by checking both the version and trusted artifact identity.

T08 · Insecure Dependencies

Warning

• Location: references/cli-commands.md:159

Finding

Unpinned npm and npx Commands Permit Mutable Dependency Execution

Content

View full analysis

Vulnerability Details

File Location: references/cli-commands.md, lines 159-165
Vulnerability Type: Unpinned dependency retrieval and execution
Risk Level: Medium

Vulnerable code:

markdown

## Installation

```bash
# Install via npm
npm install -g browseros-cli

# Or run directly without installing
npx browseros-cli --help

text

### Technical Analysis

The command reference repeats the unpinned global npm installation and additionally recommends invoking the package through `npx`. If the package is not already available locally, `npx` can retrieve package content from the configured npm registry and execute it immediately.

Neither command specifies an exact reviewed version, an integrity value, or a trusted artifact source. The effective executable can therefore change after the Skill has been reviewed. The `npx` alternative is particularly sensitive because package retrieval and execution are combined into a single command, reducing the opportunity to inspect the downloaded artifact first.

Although the demonstrated argument is only `--help`, executing a Node.js package can run arbitrary package entry-point logic, and package installation may trigger lifecycle scripts before the requested help output is produced. There is no evidence in the audited project that the package is currently malicious; the weakness is the mutable and unauthenticated dependency execution process.

### Attack Path

1. An attacker gains the ability to publish a compromised `browseros-cli` release or compromises one of its resolved dependencies or distribution channels.
2. A user or agent follows the reference documentation without having a trusted local copy pinned.
3. `npm install -g browseros-cli` or `npx browseros-cli --help` resolves the attacker-controlled package release.
4. npm downloads the mutable package and may run its lifecycle scripts.
5. In the `npx` case, the downloaded package entry point is then ex
...[truncated 838 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the unversioned npx browseros-cli --help recommendation.
• If npx is retained, use an exact reviewed version and prevent fallback to an unexpected local or remote package, for example through an organization-approved wrapper and locked registry configuration.
• Pin npm installation to an exact version and verify the package integrity and provenance before execution.
• Prefer an administrator-provisioned or project-local dependency rather than a global installation.
• Separate artifact retrieval, verification, and execution into distinct steps so the package can be inspected before any entry point runs.
• Use lockfiles, trusted registry mirrors, package allowlists, and automated dependency monitoring.
• Run installation and first execution in a sandbox with restricted filesystem, credential, browser-profile, and network access.
• Keep the primary setup instructions and command reference synchronized so secure installation guidance cannot be bypassed through the alternate documentation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

Full flags and options: see [references/cli-commands.md](references/cli-commands.md) or run `browseros-cli <command> --help`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md

Full flags and options: see [references/cli-commands.md](references/cli-commands.md) or run `browseros-cli <command> --help`.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly supports state-changing actions such as clicking, form filling, submission, downloads, uploads, and browser history/bookmark management, but it does not clearly warn that these operations can alter third-party sites or the local browser profile. In an agent setting, that omission increases the chance of unintended external actions, account changes, purchases, data submission, or persistent local state modification when the skill is invoked from natural-language prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The command reference exposes destructive browser-state operations such as closing tabs/windows, deleting history, removing bookmarks, and closing groups without any cautionary language or confirmation guidance. In an automation-oriented browser skill, these actions can cause unintended data loss, privacy-impacting deletion, or disruptive state changes if invoked by mistake or by a misleading prompt.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation section recommends running npx browseros-cli without pinning a specific version, which allows whatever version is currently published to be fetched and executed at runtime. In a browser automation skill, this increases supply-chain risk because a compromised or newly introduced malicious package version could gain broad access to browsing state, local files, cookies, screenshots, and interactive workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file includes screenshot commands that save output to screenshot.png or a user-specified path, but it does not provide any user-facing warning about creating or overwriting local files. Under the markdown criteria for missing user warnings, file-affecting behavior should be disclosed when it may impact user data or filesystem state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.