Security audit

Agent Browser Jau771

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed browser-automation skill, but it can handle sensitive logged-in browser data and saved session files if used on real accounts.

Install this only if you want an agent to control a browser. Avoid using it with sensitive logged-in accounts unless necessary, treat saved auth state files and captured artifacts as secrets, keep them out of logs and version control, and supervise actions that submit forms, upload files, change account settings, post content, or make purchases.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill manifest describes the tool as basic browser automation, but the body documents session-state save/load and credential reuse features that materially expand its security impact. Undisclosed persistence capabilities can cause an agent or user to authorize a tool for low-risk browsing while unintentionally enabling replay of authenticated sessions across runs.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The manifest omits that the tool can intercept, block, and mock network requests and responses. Those features go beyond passive automation and enable traffic manipulation, which changes the trust and abuse profile significantly for agents interacting with live services.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest does not disclose the `eval` command, which enables arbitrary JavaScript execution in the browser context. This is a materially more dangerous capability than navigation or form filling because it permits arbitrary DOM access, data extraction, and script-driven actions on authenticated pages.

Description-Behavior Mismatch

Low

Confidence: 85% confidence
Finding: The manifest understates that the tool can write screenshots, PDFs, recordings, traces, and saved auth state to local files. File output creates confidentiality and retention risks, especially when browser state or page contents contain secrets, tokens, or regulated data.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation presents file-saving and state/credential-related operations without clear privacy or system-impact warnings. In this skill context, the browser may handle authenticated sessions, cookies, uploaded files, and captured page content, so lack of warnings increases the chance of accidental data exposure or insecure storage.

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.