Security audit

browser-act

Security checks for vulnerabilities and agentic risk

Overview

The skill supports legitimate browser automation, but it asks agents to install and trust an unpinned external CLI and follow unreviewed instructions from it before every browser action.

Review before installing. Pin and verify the browser-act CLI where possible, use a dedicated automation browser profile rather than personal sessions, and treat CLI-generated guidance as untrusted unless you can verify it. Prefer simpler built-in web tools for routine public pages, and require explicit approval before browser creation, login, form submission, file upload, local Chrome access, or captcha-solving.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:46
Finding: Mandatory Loading of Unaudited External Operational Directives
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:8
Finding: Unpinned Third-Party CLI Installation Creates a Supply-Chain Execution Risk
Content: View full analysis
Remediation: View remediation
' --python 3.12 ``` 2. Require cryptographic hashes for the package and all transitive dependencies through a locked dependency manifest. 3. Use a trusted package index and verify package publisher and artifact provenance. 4. Prefer signed releases and verify signatures before installation. 5. Review package source and dependency changes before updating the pinned version. 6. Prevent automatic upgrades from silently replacing the reviewed executable. 7. Run the CLI in a sandbox with narrowly scoped filesystem and network access. 8. Separate browser profiles used for automation from personal browser profiles and high-value authenticated sessions. 9. Restrict outbound network access to documented destinations, including an explicitly identified CAPTCHA service if that optional feature is enabled. 10. Require explicit user approval before installation and before any update that changes the executable or dependency lock file. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation guidance is excessively broad and captures many ordinary web-browsing, fetching, and content-extraction tasks that could be handled by narrower built-in tools. This increases unnecessary invocation of a high-capability browser automation tool with network, session, upload, and interaction features, expanding the attack surface and making prompt-triggered misuse more likely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs the agent to always invoke this skill first and to prefer it over built-in fetch or web tools, which overrides normal least-privilege tool selection. That coercive routing can cause unnecessary use of a more powerful tool and may bypass safer defaults, especially when handling untrusted URLs or routine browsing tasks.
Content: No source excerpt is available for this finding.

Static analysis

Detected: malicious.stealth_browser_abuse

Browser automation advertises stealth/anti-detection behavior with bot-protection bypass and persistent sessions.

Critical

Code: malicious.stealth_browser_abuse
Location: SKILL.md:34