my-browser-bot

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:34 AM UTC
• Version: 1.0.4

Overview

This is a browser automation skill with a coherent purpose, but it asks users to install and run mutable external executable components and gives broad web-action powers without clear safety boundaries.

Review this carefully before installing. Use it only in a sandboxed or low-privilege environment, avoid giving it access to sensitive browser sessions or credentials, and require explicit confirmation before downloads, form submissions, payments, account changes, or handling private page content. Prefer a pinned, verified release with documented source and Chromium provenance.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:17

Finding

Unpinned Executable Dependency and Unverified Browser Download

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-18
Vulnerability Type: Unpinned third-party dependency and unverified secondary executable download
Risk Level: High

Vulnerable Code

bash

pipx install mybrowser-skill
mybrowser-skill install   # Download Chromium

Technical Analysis

The installation instructions install the latest available version of the mybrowser-skill package without a fixed version, integrity hash, lockfile, or publisher verification. The newly installed package is then executed and instructed to download Chromium through a package-controlled installation process.

Because the effective package version and secondary browser payload can change after this Skill has been reviewed, the repository does not provide enough information to verify the code that will ultimately execute. The project contains no implementation, checksum, signature, trusted download endpoint, or reproducible dependency manifest for either component.

This creates a supply-chain risk: compromise of the package registry account, publication of a malicious package version, dependency confusion, or compromise of the browser download channel could cause arbitrary attacker-controlled code to execute.

Attack Path

1. An attacker compromises the mybrowser-skill package, its publisher account, its distribution channel, or a dependency resolved during installation.
2. The attacker publishes or substitutes a malicious package release while retaining the expected package name.
3. A user follows the documented command pipx install mybrowser-skill, which resolves the mutable latest release without verifying a version or hash.
4. Installation hooks or package entry points execute attacker-controlled code, or the malicious CLI is installed for later execution.
5. The user runs mybrowser-skill install.
6. The compromised CLI retrieves or installs an attacker-controlled Chromium payload without a doc ...[truncated 869 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin mybrowser-skill to a specific, audited version rather than installing the latest mutable release.
2. Use a reproducible dependency manifest and require cryptographic hashes, such as a hash-locked requirements file installed with hash verification.
3. Document the canonical package repository, source repository, publisher identity, and expected package provenance.
4. Pin the Chromium build to an approved version and verify its cryptographic checksum or publisher signature before installation or execution.
5. Restrict browser downloads to an allowlisted HTTPS origin and fail closed on certificate, signature, or checksum verification errors.
6. Audit and vendor the executable implementation where practical so reviewers can verify the behavior invoked by the Skill.
7. Run installation and browser automation in a sandboxed, least-privileged environment without access to unrelated credentials or sensitive host files.
8. Separate package installation from routine Skill invocation and require explicit user approval before downloading or executing additional components.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is extremely broad and authorizes general-purpose website interaction, form filling, clicking, downloading, tab management, and data extraction with little scoping or safety gating. In an agent setting, this increases the chance the skill will be invoked for sensitive, privacy-impacting, or system-impacting actions on arbitrary sites, including credential entry, file download, or unintended transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation presents powerful browser automation primitives without warning about privacy, credential handling, downloads, file execution risk, navigation to untrusted sites, or side effects like submitting forms and changing account state. In practice, this can normalize unsafe use by agents and operators, leading to accidental disclosure of sensitive page contents or unintended real-world actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.