Security audit

browser-automation

Security checks across malware telemetry and agentic risk

Overview

This browser automation skill is purpose-built, but it can control logged-in browsing sessions, use a remote service automatically, and persist screenshots, downloads, cookies, and passwords with limited user control.

Install only if you are comfortable with an agent controlling browser sessions and potentially routing page context through SkillBoss API Hub. Use isolated test profiles and test accounts, avoid entering real passwords or regulated data, review screenshot and download directories, and require explicit confirmation before submitting forms, downloading files, or acting on logged-in/private sites.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The examples demonstrate filling and submitting a live contact form using realistic personal data but do not warn that running the workflow may transmit user-provided information to a third party or trigger real-world actions. In an automation skill, omission of such warnings can cause unintended disclosure of personal data or accidental submissions, especially if users copy examples verbatim against production sites.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The login example includes credentials and explicitly notes use of a persistent Chrome profile, which can retain session cookies and authentication state across runs, yet it lacks strong warnings about credential exposure, session reuse, and cross-task contamination. In a shared or agent-driven environment, this increases the chance of unauthorized account access, accidental actions under a retained session, or leakage of authenticated context between users or tasks.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The download example states that files are automatically written to a local directory but does not clearly warn users that executing the workflow will create local files from remote content. This can lead to unexpected disk writes, storage of sensitive or malicious files, and confusion about where downloaded artifacts are persisted.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The reference states that `act` uses Stagehand via the SkillBoss API Hub but does not clearly warn users that their natural-language prompts and potentially page-derived context may be sent to an external service. In a browser automation tool, those prompts can contain credentials, personal data, internal URLs, or sensitive workflow details, so omission of an explicit disclosure creates a real privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document says downloads are automatically allowed and saved locally without a confirmation dialog, but it does not present this as a user-facing safety warning. This can lead to silent storage of untrusted files, disk consumption, or accidental handling of malicious payloads, especially because the browser can visit arbitrary sites and download content automatically.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The skill description is broad enough to match many generic browsing requests, which can cause the agent to invoke this high-capability browser automation skill in situations where a narrower or safer tool would suffice. Because the skill can navigate, extract, click, and fill forms, overbroad routing increases the chance of unintended web interaction, data submission, or exposure to untrusted content.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill silently switches to a remote browsing service whenever an API key is present, without informing the user that page contents, session activity, and possibly entered data may be processed outside the local environment. This creates a hidden data-handling boundary change that can expose sensitive browsing activity or credentials to a third-party service when the user reasonably expects local browser automation.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.