Fast Agent Browser

• Outcome: Review
• Latest audit: May 28, 2026 · 1:51 AM UTC
• Version: 1.1.0

Overview

This browser automation skill fits its stated purpose, but it needs review because it exposes broad browser control while making overly broad safety claims.

Install only if you are comfortable giving an agent real browser-control authority. Use it with isolated browser profiles or test accounts, avoid sensitive sessions unless necessary, do not save or share cookies/auth-state files casually, and require explicit confirmation before submissions, uploads, purchases, account changes, or custom JavaScript execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation asserts that all commands are safe and do not execute arbitrary code, yet the skill explicitly documents an `eval` command for executing JavaScript in the browser context. That contradiction can mislead users or downstream agents into trusting a capability that can run attacker-controlled script against loaded pages, interact with authenticated sessions, and trigger unintended actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The eval method exposes unrestricted JavaScript execution in the page context, which is broader than ordinary browser automation primitives like click, fill, and navigate. If higher-level agent inputs are attacker-controlled, this becomes a powerful capability for DOM manipulation, data extraction, bypassing workflow restrictions, and executing arbitrary in-browser actions against authenticated sessions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly documents saving auth state, inspecting cookies, and setting session cookies, but provides no warning that these artifacts may contain sensitive bearer tokens or authenticated session material. In an AI-agent/browser-automation context, this increases the chance that users or downstream agents will persist, expose, replay, or mishandle credentials, enabling account takeover or unauthorized session reuse.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill introduces browser automation without warning that opening pages, clicking links, filling forms, or taking actions will send requests and user-provided data to remote websites. In an AI-agent setting, this omission increases the chance that operators unknowingly expose sensitive information or permit automated interaction with untrusted sites.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The advanced usage section demonstrates form submission, uploads, scrolling, and JavaScript execution without warning that these actions may be irreversible, state-changing, or harmful. In practice, an agent could submit forms, upload local files, alter account settings, or execute page-context JavaScript on behalf of a user without adequate caution.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This file provides arbitrary JavaScript execution without any warning, disclosure, or indication that consumers are invoking a high-risk capability. In an agent setting, hidden access to page.evaluate can materially expand what downstream prompts or tools can do, increasing the chance of unsafe data access or unintended browser-side actions without operator awareness.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
click>=8.1.0
pydantic>=2.5.0
rich>=13.7.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower-bound only (>=), which allows installation of any newer release and makes builds non-reproducible. This increases supply-chain risk because a future breaking or compromised version could be pulled in without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
click>=8.1.0
pydantic>=2.5.0
rich>=13.7.0

• Confidence: 95% confidence
• Finding: The dependency is unpinned and uses a minimum-version specifier, so installations may resolve to different versions over time. That creates avoidable supply-chain exposure and can introduce vulnerable or incompatible releases unexpectedly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
click>=8.1.0
pydantic>=2.5.0
rich>=13.7.0

• Confidence: 98% confidence
• Finding: Pydantic is not pinned, so the environment may resolve to different versions across installs, weakening reproducibility and control over transitive risk. Because this package also has known advisories in some versions, leaving it unpinned increases the chance of resolving to an affected release.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
click>=8.1.0
pydantic>=2.5.0
rich>=13.7.0

• Confidence: 94% confidence
• Finding: Using rich>=13.7.0 permits any later version to be installed, which undermines reproducibility and dependency governance. While not directly exploitable by itself, it increases the chance of unintentionally consuming a bad or vulnerable release.

Known Vulnerable Dependency: pydantic — 3 advisory(ies): CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The requirements allow pydantic versions that may include known vulnerabilities, including a reported regular-expression denial of service and earlier parsing-related issues. If this skill processes untrusted input through affected pydantic validation paths, an attacker could trigger excessive CPU consumption or other denial-of-service behavior.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/browser.py:398