T09 · Insecure Skill Coding Practices
Error
- Location
- EXAMPLES.md:109
- Finding
- Credentials May Be Disclosed Through Third-Party AI-Processed Browser Actions## Vulnerability Details **File Location**: `EXAMPLES.md:109-117` **Supporting Locations**: `REFERENCE.md:82-88`, `REFERENCE.md:341-348` **Vulnerability Type**: Sensitive data exposure through an external AI service **Risk Level**: High ### Vulnerable Code Snippets `EXAMPLES.md:109-117`: ```bash 2. **Act**: Fill in username: ```bash browser act "Fill in the username field with 'myusername'" ``` 3. **Act**: Fill in password: ```bash browser act "Fill in the password field with 'mypassword'" ``` ``` `REFERENCE.md:82-88`: ```markdown **Implementation Details**: - Uses Stagehand's `page.act()` which leverages SkillBoss API Hub (auto-routed) - AI model interprets natural language and executes corresponding browser actions ``` `REFERENCE.md:341-348`: ```typescript new Stagehand({ env: "LOCAL", verbose: 0, enableCaching: true, model: "skillboss/auto", // routed via SkillBoss API Hub (https://api.heybossai.com/v1/pilot) localBrowserLaunchOptions: { cdpUrl: wsUrl, }, }) ``` ### Technical Analysis The documented login workflow places the password directly inside the natural-language argument passed to `browser act`. The reference states that `page.act()` uses an auto-routed SkillBoss API Hub AI model and identifies the external endpoint as `https://api.heybossai.com/v1/pilot`. Consequently, a real password entered according to the documented workflow may become part of a request sent to a third-party AI service. Running Chrome locally does not necessarily keep action instructions local: the browser environment is configured as `LOCAL`, while interpretation of the action is separately routed through the external model. The documentation does not describe a local selector-based secret-entry mechanism, sensitive-value redaction, explicit consent before external transmission, or the external provider's logging and retention behavior. The audited package ...[truncated 1493 chars]
- Remediation
- ## Remediation Suggestions 1. Prohibit passwords, tokens, recovery codes, and similar secrets in natural-language `browser act` prompts. 2. Add a local-only secret-entry command that accepts a selector and reads the value through a protected channel, such as standard input without echo or an approved secret manager. 3. Ensure secret values are injected directly into the local Playwright/CDP operation and are never included in model prompts, logs, screenshots, caches, exceptions, or telemetry. 4. Implement automatic sensitive-field detection and reject AI-mediated actions containing plaintext values for password, token, or payment fields. 5. Clearly notify users when page content or action instructions will be sent to an external AI provider, and require explicit consent before transmission. 6. Document the provider endpoint, data retention policy, logging behavior, subprocessors, encryption controls, and deletion process. 7. Add automated tests using sentinel secrets to verify that outbound AI requests, application logs, and cached artifacts never contain sensitive values. 8. Replace the password example with a secure workflow, for example: ```bash browser type-secret --selector 'input[type="password"]' ``` The command should prompt locally for the value and inject it without sending the value to an AI model. 9. Avoid capturing screenshots immediately after secret entry unless password masking is verified, and disable model-analysis caching for authentication workflows.