T09 · Insecure Skill Coding Practices
- Location
EXAMPLES.md:109- Finding
Credentials May Be Disclosed Through Third-Party AI-Processed Browser Actions
- Content
View full analysis
Vulnerability Details
File Location:
EXAMPLES.md:109-117
Supporting Locations:REFERENCE.md:82-88,REFERENCE.md:341-348
Vulnerability Type: Sensitive data exposure through an external AI service
Risk Level: HighVulnerable Code Snippets
EXAMPLES.md:109-117:bash 2. **Act**: Fill in username: ```bash browser act "Fill in the username field with 'myusername'" ``` 3. **Act**: Fill in password: ```bash browser act "Fill in the password field with 'mypassword'" ```REFERENCE.md:82-88:markdown **Implementation Details**: - Uses Stagehand's `page.act()` which leverages SkillBoss API Hub (auto-routed) - AI model interprets natural language and executes corresponding browser actionsREFERENCE.md:341-348:typescript new Stagehand({ env: "LOCAL", verbose: 0, enableCaching: true, model: "skillboss/auto", // routed via SkillBoss API Hub (https://api.heybossai.com/v1/pilot) localBrowserLaunchOptions: { cdpUrl: wsUrl, }, })Technical Analysis
The documented login workflow places the password directly inside the natural-language argument passed to
browser act. The reference states thatpage.act()uses an auto-routed SkillBoss API Hub AI model and identifies the external endpoint ashttps://api.heybossai.com/v1/pilot.Consequently, a real password entered according to the documented workflow may become part of a request sent to a third-party AI service. Running Chrome locally does not necessarily keep action instructions local: the browser environment is configured as
LOCAL, while interpretation of the action is separately routed through the external model.The documentation does not describe a local selector-based secret-entry mechanism, sensitive-value redaction, explicit consent before external transmission, or the external provider's logging and retention behavior. The audited package ...[truncated 1493 chars]
- Remediation
View remediation
Remediation Suggestions
-
Prohibit passwords, tokens, recovery codes, and similar secrets in natural-language
browser actprompts. -
Add a local-only secret-entry command that accepts a selector and reads the value through a protected channel, such as standard input without echo or an approved secret manager.
-
Ensure secret values are injected directly into the local Playwright/CDP operation and are never included in model prompts, logs, screenshots, caches, exceptions, or telemetry.
-
Implement automatic sensitive-field detection and reject AI-mediated actions containing plaintext values for password, token, or payment fields.
-
Clearly notify users when page content or action instructions will be sent to an external AI provider, and require explicit consent before transmission.
-
Document the provider endpoint, data retention policy, logging behavior, subprocessors, encryption controls, and deletion process.
-
Add automated tests using sentinel secrets to verify that outbound AI requests, application logs, and cached artifacts never contain sensitive values.
-
Replace the password example with a secure workflow, for example:
bash browser type-secret --selector 'input[type="password"]'The command should prompt locally for the value and inject it without sending the value to an AI model.
-
Avoid capturing screenshots immediately after secret entry unless password masking is verified, and disable model-analysis caching for authentication workflows.
-