Browser Automation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:34 AM UTC
• Version: 1.0.2

Overview

This browser automation skill is purpose-aligned but needs review because it can automatically use a remote browser, retain login sessions, expose a browser-control port, and download files without strong upfront controls.

Install only if you are comfortable with a powerful browser automation tool. Avoid using it with real credentials, regulated data, internal sites, or sensitive accounts unless you isolate the browser profile, understand whether Browserbase remote mode is active, and verify the actual source code and dependencies behind the global browser command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: REFERENCE.md:360
• Finding: Persistent Authenticated Browser Profile Exposed Through an Unprotected Debugging Interface## Vulnerability Details **File Location**: `REFERENCE.md:16`, `REFERENCE.md:360-378`, `REFERENCE.md:384-393`, `REFERENCE.md:458-471`; `EXAMPLES.md:144` **Vulnerability Type**: Persistent session exposure and insecure browser-debugging configuration **Risk Level**: Medium ### Evidence `REFERENCE.md:16`: ```markdown - **Chrome Profile**: `.chrome-profile/` - Persistent browser profile directory ``` `REFERENCE.md:360-378`: ```markdown ### Chrome Launch Arguments Chrome is launched by `src/cli.ts` with: ```bash --remote-debugging-port=9222 --user-data-dir=.chrome-profile --window-position=-9999,-9999 --window-size=1280,720 ``` **Arguments**: - `--remote-debugging-port`: Enables CDP on port 9222 - `--user-data-dir`: Persistent profile directory for session/cookie persistence - `--window-position`: Launches minimized off-screen - `--window-size`: Default window size ``` `REFERENCE.md:384-393`: ```markdown ```typescript await client.send("Browser.setDownloadBehavior", { behavior: "allow", downloadPath: "./agent/downloads", eventsEnabled: true, }) ``` **Behavior**: - Downloads start automatically (no dialog) - Files saved to `./agent/downloads/` - Download events can be monitored via CDP ``` `REFERENCE.md:458-471`: ```markdown ### Credential Handling - Browser uses persistent profile (`.chrome-profile/`) - Saved passwords and cookies persist between sessions - Consider using isolated profiles for sensitive operations ### Download Safety - Downloads automatically saved to `./agent/downloads/` - No file type restrictions enforced - Verify downloaded file integrity before use ### Network Access - Browser has full network access - Respects system proxy settings - Can access localhost and internal networks ``` `EXAMPLES.md:144`: ```markdown **Note**: This example uses Chrome's user profile (`.chrome-profile/`) which may preserve session ...[truncated 3270 chars]
• Remediation: ## Remediation Suggestions 1. **Use ephemeral profiles by default** - Create a unique temporary Chrome profile for every task. - Delete the profile during cleanup, including after failures and timeouts. - Require explicit user consent before retaining cookies or login state. 2. **Protect the CDP endpoint** - Bind the debugging service explicitly to `127.0.0.1` or an equivalent local-only interface. - Use a randomized, per-run port rather than fixed port `9222`. - Do not expose CDP through externally reachable interfaces, containers, or forwarded ports. - Where supported, place the endpoint behind an authenticated local transport or use a private pipe instead of a TCP listener. 3. **Isolate sensitive sessions** - Never reuse a user's normal Chrome profile. - Separate profiles by user, task, and trust domain. - Disable password storage and unnecessary browser synchronization in automation profiles. - Clear cookies, local storage, service workers, caches, and authentication tokens when a task finishes. 4. **Restrict browser network access** - Block localhost, link-local, private-address, and internal-network destinations unless explicitly required. - Apply destination allowlists for narrowly scoped automation tasks. - Prevent redirects from approved public destinations to restricted internal addresses. 5. **Harden download handling** - Require confirmation before downloads. - Apply file-type, size, and destination restrictions. - Store downloads in a unique non-executable temporary directory. - Scan downloaded files and never execute them automatically. 6. **Provide verifiable implementation controls** - Include the referenced source code, package manifest, and lockfile in the artifact. - Add automated tests confirming that CDP is loopback-only, profiles are isolated, and cleanup removes persistent session data. - Document the exact runtime bind ad ...[truncated 80 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The documentation states that the skill automatically switches to Browserbase when API keys are present, but it does not warn that browsing actions, page contents, screenshots, and extracted data may be sent to a third-party remote browser service. This creates a meaningful confidentiality and compliance risk, especially if users assume all browsing stays local.

Credential Access

High

• Category: Privilege Escalation

Content

### First: Environment Selection (Local vs Remote)

The skill automatically selects between local and remote browser environments:
- **If Browserbase API keys exist** (BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in .env file): Uses remote Browserbase environment
- **If no Browserbase API keys**: Falls back to local Chrome browser
- **No user prompting**: The selection happens automatically based on available configuration

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### First: Environment Selection (Local vs Remote)

The skill automatically selects between local and remote browser environments:
- **If Browserbase API keys exist** (BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in .env file): Uses remote Browserbase environment
- **If no Browserbase API keys**: Falls back to local Chrome browser
- **No user prompting**: The selection happens automatically based on available configuration

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### First: Environment Selection (Local vs Remote)

The skill automatically selects between local and remote browser environments:
- **If Browserbase API keys exist** (BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in .env file): Uses remote Browserbase environment
- **If no Browserbase API keys**: Falls back to local Chrome browser
- **No user prompting**: The selection happens automatically based on available configuration

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The examples normalize entering personal information and credentials into websites without any explicit privacy/safety warning, user-consent check, or guidance about trusted domains and handling secrets. In a browser automation skill, this increases the risk of users or downstream agents submitting sensitive data to phishing pages, unintended recipients, or pages that persist session state via the shared Chrome profile.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The download example states that files are automatically written to a local directory without prominently warning about local persistence, file safety, or the risk of downloading untrusted content. In this skill context, browser-driven downloads can store sensitive or malicious files on disk unexpectedly, which is more dangerous because the automation encourages direct interaction with arbitrary remote URLs.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The architecture section mentions a persistent Chrome profile directory, but does not clearly warn near the primary workflow descriptions that cookies, sessions, and possibly saved credentials persist across runs. In this skill context, persistence materially increases the risk of cross-task data leakage, unintended account reuse, and exposure of authenticated state when the browser is later directed to attacker-controlled or unrelated sites.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The reference documents that downloads are automatically allowed and saved to a local directory, but it does not prominently warn users in the command workflow that invoking browser actions may write untrusted files to disk. In a browser automation skill with full network access, this increases the risk of silently persisting malicious payloads, sensitive documents, or large files that affect system safety and storage hygiene.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill description is broad enough to trigger on many generic browsing or web-interaction requests, which increases the chance the agent invokes this capability in situations where browser automation is unnecessary or risky. Because the skill can navigate sites, extract data, and interact with web applications, overbroad routing expands exposure to data leakage, unintended actions, and phishing-style workflows.

Static analysis

No suspicious patterns detected.