broswer use skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:50 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is mostly coherent, but it combines powerful browser control with mutable global installation/update paths and skill-script execution without enough safety boundaries.

Review this carefully before installing. Use it only in a low-risk browser profile, avoid sensitive logged-in sessions unless you are supervising each action, do not send screenshots to an LLM when pages contain private data, and prefer pinned or reviewed browser-cli versions over global latest installs or self-updates.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:50
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, line 50 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown - `browser-cli` installed globally: `npm install -g browser-cli` ``` ### Technical Analysis The installation command does not specify an exact package version or integrity hash. It therefore retrieves whichever version of `browser-cli` the npm registry currently resolves as the latest release. The project provides no lockfile, checksum, vendored source, or other mechanism for verifying the retrieved artifact. The global installation scope is particularly sensitive because npm installation can execute package lifecycle scripts with the permissions of the invoking user. The installed package is subsequently entrusted with extensive browser-control capabilities, including reading page content, filling forms, uploading files, capturing screenshots, downloading data, and invoking Skill scripts. This is a supply-chain weakness rather than evidence that the current `browser-cli` release is malicious. Exploitation requires compromise or malicious replacement of the package, its publisher account, or its dependency chain. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution channel, or a transitive dependency used by `browser-cli`. 2. The attacker publishes a malicious release that becomes the version resolved by the unpinned installation command. 3. A user or agent follows the Skill instructions and executes `npm install -g browser-cli`. 4. npm downloads and installs the mutable release and may execute attacker-controlled lifecycle scripts. 5. Malicious code runs with the invoking user's permissions and can potentially abuse the installed tool's browser and filesystem access. ### Impact Assessment Successful exploitation could provide code execution with the permissions of the user runn ...[truncated 570 chars]
• Remediation: ## Remediation Suggestions - Pin `browser-cli` to a reviewed, exact version rather than implicitly installing the latest release. - Verify the package against a trusted integrity hash or a controlled lockfile before installation. - Document the authoritative npm package and source repository so users can detect typosquatting or package substitution. - Prefer a project-local installation with least-privilege execution over a global installation. - Disable or review npm lifecycle scripts where operationally possible, such as by initially inspecting packages with scripts disabled. - Review the pinned package and its transitive dependencies before granting it access to authenticated browser sessions or sensitive files. - Introduce a controlled upgrade process that requires security review before changing the pinned version.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:135
• Finding: Uncontrolled Self-Update to the Latest Third-Party Release## Vulnerability Details **File Location**: `SKILL.md`, line 135 **Vulnerability Type**: Unverified self-update mechanism **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash browser-cli update # Self-update to latest version ``` ### Technical Analysis The Skill documents a self-update command that upgrades the executable to the latest available release without specifying a reviewed version, trusted checksum, signature-verification requirement, or approval step. This permits the effective code executed by the Skill to change after the Skill itself has been audited. Because the implementation of `browser-cli` and its updater is not included in the reviewed project, the audit cannot verify the update source, transport validation, package-signing behavior, rollback protections, or whether updates execute installation hooks. The confirmed weakness is the recommendation to accept mutable third-party code without documented verification controls, not proof that the current update service is malicious. ### Attack Path 1. An attacker compromises the package publisher, update source, release process, or dependency supply chain. 2. A malicious version is published as the latest release. 3. A user or agent invokes `browser-cli update` according to the Skill documentation. 4. The updater retrieves and installs the compromised release without a documented version pin or independent integrity check. 5. The malicious release executes under the user's account and inherits access available to the browser automation tool. ### Impact Assessment Exploitation could result in arbitrary code execution with the privileges of the user running the updater. It could also compromise the browser-control channel and expose or manipulate browser tabs, page content, screenshots, form values, file uploads, downloads, and authenticated browser workflows. The impact extends beyond a single browser action because the installed CLI itself ma ...[truncated 190 chars]
• Remediation: ## Remediation Suggestions - Remove automatic “update to latest” guidance from routine workflows. - Require updates to target an explicitly approved version. - Verify release signatures or cryptographic checksums through an independent trusted channel. - Document the update source and the updater's verification behavior. - Perform dependency and source review before approving each new release. - Use staged deployment and rollback procedures rather than updating production or sensitive environments directly. - Run the updater and browser automation tool with the minimum filesystem and browser permissions required. - Avoid updating while authenticated sensitive browser sessions are connected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Self-Modification

High

• Category: Rogue Agent

Content

```bash
browser-cli status    # Check daemon + extension connection
browser-cli update    # Self-update to latest version
```

---

• Confidence: 91% confidence
• Finding: A self-update command changes the executable after deployment and can bypass the reviewed skill version, undermining reproducibility and trust. In an agent environment, invoking `browser-cli update` could pull and execute new code without review, enabling supply-chain compromise or policy circumvention.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This skill can click buttons, fill forms, switch tabs, and otherwise mutate browser state, but the documentation does not warn that these actions may submit forms, trigger purchases, change account settings, or interact with authenticated sessions. In an agent setting, omission of that warning increases the chance of unsafe autonomous use on sensitive pages.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The examples include screenshot capture with `--send-to-llm true`, which may transmit full-page visual content and potentially sensitive information to an LLM or remote service. Without an explicit privacy warning, users and agents may expose credentials, personal data, internal documents, or authenticated content unintentionally.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

```bash
browser-cli interact click btn-42 --tab 123                         # Click by UID
browser-cli interact fill input-5 "hello world" --tab 123           # Fill input by UID
browser-cli interact hover menu-3 --tab 123                         # Hover by UID
browser-cli interact form --tab 123 --elements '[{"uid":"in-1","value":"foo"}]'  # Batch fill
browser-cli interact editor editor-1 --tab 123                     # Get editor content

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

```bash
browser-cli interact click btn-42 --tab 123                         # Click by UID
browser-cli interact fill input-5 "hello world" --tab 123           # Fill input by UID
browser-cli interact hover menu-3 --tab 123                         # Hover by UID
browser-cli interact form --tab 123 --elements '[{"uid":"in-1","value":"foo"}]'  # Batch fill
browser-cli interact editor editor-1 --tab 123                     # Get editor content

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

```bash
browser-cli interact click btn-42 --tab 123                         # Click by UID
browser-cli interact fill input-5 "hello world" --tab 123           # Fill input by UID
browser-cli interact hover menu-3 --tab 123                         # Hover by UID
browser-cli interact form --tab 123 --elements '[{"uid":"in-1","value":"foo"}]'  # Batch fill
browser-cli interact editor editor-1 --tab 123                     # Get editor content

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

```bash
browser-cli interact click btn-42 --tab 123                         # Click by UID
browser-cli interact fill input-5 "hello world" --tab 123           # Fill input by UID
browser-cli interact hover menu-3 --tab 123                         # Hover by UID
browser-cli interact form --tab 123 --elements '[{"uid":"in-1","value":"foo"}]'  # Batch fill
browser-cli interact editor editor-1 --tab 123                     # Get editor content

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

```bash
browser-cli interact click btn-42 --tab 123                         # Click by UID
browser-cli interact fill input-5 "hello world" --tab 123           # Fill input by UID
browser-cli interact hover menu-3 --tab 123                         # Hover by UID
browser-cli interact form --tab 123 --elements '[{"uid":"in-1","value":"foo"}]'  # Batch fill
browser-cli interact editor editor-1 --tab 123                     # Get editor content

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill is presented as a browser-control tool, but it also exposes AIPex skill-management operations including `skill run`, which can execute arbitrary skill scripts. That materially expands capability beyond the declared purpose and creates a privilege-escalation path from browser automation into local code execution or access to other skill assets.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

| Symptom | Fix |
|---------|-----|
| `Daemon not running` | Run any command to auto-spawn, or check with `browser-cli status` |
| `Extension is not connected` | Open AIPex Options → WebSocket URL `ws://localhost:9223/extension` → Connect |
| Port 9223 in use | Use `--port 9224` and update extension URL |
| Timeout after 60s | Verify extension is connected. Increase with `BROWSER_CLI_CONNECT_TIMEOUT=120000` |

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The download commands write markdown and image content to local storage, but the skill text does not clearly warn about filesystem side effects. In automation contexts, silent file creation can overwrite data, store sensitive content locally, or place files in locations later consumed by other tools.

Static analysis

No suspicious patterns detected.