Browser Automation Zero Token

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

This is a coherent browser-automation guide, but users should treat saved browser login state as sensitive account access material.

Install this only if you want an agent to control browser sessions and automate sites you are authorized to use. Treat any saved auth.json or similar browser state file like a password: keep it out of source control, store it somewhere protected, use separate files per site/account, and delete or rotate it when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly recommends saving and loading browser authentication state to `auth.json` but does not warn that such state commonly contains session cookies or bearer-like artifacts that can enable account hijacking if copied or reused. In a browser automation skill focused on repetitive login/sign-in flows, this omission is materially risky because users are encouraged to persist reusable authenticated state without guidance on secure storage, scoping, rotation, or cleanup.

VirusTotal

66/66 vendors flagged this skill as clean.