Security audit

Browser Automation

Security checks across malware telemetry and agentic risk

Overview

This browser-automation skill is not malicious, but it needs review because it can drive a browser broadly, persist sessions, save files, access internal sites, and silently use a remote browser service when keys are present.

Review before installing. Use a disposable browser profile, avoid sensitive accounts unless you explicitly intend session persistence, remove Browserbase keys if you do not want remote browsing, monitor and clean ./agent/downloads and ./agent/browser_screenshots, and verify the missing CLI/package source before relying on the setup commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The reference explicitly documents automatic downloads to a local directory with no file type restrictions and no user confirmation. In an agentic browser skill, this expands the tool from passive browsing into arbitrary file-write capability, which can be abused to drop untrusted content to disk or fill storage during web interactions.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The documentation states the browser can access localhost and internal networks, which materially broadens the trust boundary beyond ordinary public web browsing. In an LLM-controlled browser tool, this creates SSRF-style risk, allowing navigation to internal services, local admin panels, metadata endpoints, or developer interfaces that may be reachable only from the host environment.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The login example encourages entering hardcoded credentials and notes that the Chrome profile may persist session cookies between runs, but it provides no warning about secret handling, session reuse, or cross-task data exposure. In an agent environment, this can lead to credential leakage, unintended account access, or reuse of authenticated state by later tasks.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The download example states only in a note that files are automatically written to a local directory, without warning about the security implications of storing remote content on disk. This can cause users or downstream agents to unknowingly retain sensitive, untrusted, or malicious files locally, increasing exposure to accidental use or later processing.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Describing no-dialog automatic saving without a strong warning understates that normal browser friction has been removed and files will be written silently. That makes accidental or prompt-induced downloads more likely, especially when combined with AI-driven browsing that may follow links or trigger download actions indirectly.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation description is broad enough to capture many generic browsing and web interaction requests, which can cause the skill to be selected in situations involving sensitive sites, authenticated sessions, or form submission without adequate narrowing. In a browser-automation skill, overbroad activation increases the chance of unintended web actions or data exposure because the tool can navigate, click, fill forms, and extract content from arbitrary sites.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill states it will automatically choose a remote Browserbase environment whenever API keys are present, with no user prompting. That creates a silent trust-boundary change: browsing activity, page contents, cookies, and possibly user-entered data may be sent to a third-party remote service without explicit consent or visibility.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.