Browser Use 1.0.0

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:29 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Browser Use cloud integration, but it handles persisted browser logins and suggests syncing local Chrome cookies to a cloud browser without enough warning or scoping.

Review before installing. Use only dedicated, low-privilege browser profiles and avoid syncing personal, banking, admin, email, or work Chrome sessions into the cloud browser. Delete profiles when no longer needed, protect the Browser Use API key, and treat any autonomous task run with an authenticated profile as capable of acting inside those accounts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The tip about syncing cookies from local Chrome to the cloud service omits a critical warning that this transfers local authentication artifacts off-device. That can expose active sessions for email, banking, admin consoles, or other sensitive services to a third-party environment, effectively extending account access into the cloud browser.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

ofiles" -H "X-Browser-Use-API-Key: $API_KEY"

# Create profile
curl -X POST "https://api.browser-use.com/api/v2/profiles" \
  -H "X-Browser-Use-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "My Profile"}'

# Delete profile
curl -X DELETE "https://api.browser-use.com/api/v2/profiles/<profile-id>" \
  -H "X-Browser-Use-API-Key: $API_KEY"
```

**Tip:** You can also sync cookies from your local Chrome using the Browser Use Chrome extension.

---

## 3. Tasks (Subagent)

Run autonomous browser tasks - like a subagent that handles browser interactions for you. Give it a prompt and it completes the task.

**Always use `browser-use-llm`** - optimized for browser tasks, 3-5x faster than other models.

```bash
curl -X POST "https://api.browser-use.com/api/v2/tasks" \
  -H "X-Browser-Use-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "task": "Go to amazon.com and find the price of the MacBook Air M3",
    "llm": "browser-use-llm"
  }'
```

#

• Confidence: 91% confidence
• Finding: Although this is not explicit malware, the instruction to sync cookies from local Chrome into a cloud-browser platform closely matches credential-transfer behavior associated with information-stealer patterns. In this skill context, the feature is especially dangerous because persisted cloud profiles and autonomous browser control can turn imported cookies into durable access to sensitive authenticated accounts.

External Transmission

Medium

• Category: Data Exfiltration

Content

> clawdbot config set skills.entries.browser-use.apiKey "bu_your_key_here"
> ```

Base URL: `https://api.browser-use.com/api/v2`

All requests need header: `X-Browser-Use-API-Key: <apiKey>`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

> clawdbot config set skills.entries.browser-use.apiKey "bu_your_key_here"
> ```

Base URL: `https://api.browser-use.com/api/v2`

All requests need header: `X-Browser-Use-API-Key: <apiKey>`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

> clawdbot config set skills.entries.browser-use.apiKey "bu_your_key_here"
> ```

Base URL: `https://api.browser-use.com/api/v2`

All requests need header: `X-Browser-Use-API-Key: <apiKey>`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

> clawdbot config set skills.entries.browser-use.apiKey "bu_your_key_here"
> ```

Base URL: `https://api.browser-use.com/api/v2`

All requests need header: `X-Browser-Use-API-Key: <apiKey>`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

> clawdbot config set skills.entries.browser-use.apiKey "bu_your_key_here"
> ```

Base URL: `https://api.browser-use.com/api/v2`

All requests need header: `X-Browser-Use-API-Key: <apiKey>`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

> clawdbot config set skills.entries.browser-use.apiKey "bu_your_key_here"
> ```

Base URL: `https://api.browser-use.com/api/v2`

All requests need header: `X-Browser-Use-API-Key: <apiKey>`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

> clawdbot config set skills.entries.browser-use.apiKey "bu_your_key_here"
> ```

Base URL: `https://api.browser-use.com/api/v2`

All requests need header: `X-Browser-Use-API-Key: <apiKey>`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

> clawdbot config set skills.entries.browser-use.apiKey "bu_your_key_here"
> ```

Base URL: `https://api.browser-use.com/api/v2`

All requests need header: `X-Browser-Use-API-Key: <apiKey>`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

> clawdbot config set skills.entries.browser-use.apiKey "bu_your_key_here"
> ```

Base URL: `https://api.browser-use.com/api/v2`

All requests need header: `X-Browser-Use-API-Key: <apiKey>`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

> clawdbot config set skills.entries.browser-use.apiKey "bu_your_key_here"
> ```

Base URL: `https://api.browser-use.com/api/v2`

All requests need header: `X-Browser-Use-API-Key: <apiKey>`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

> clawdbot config set skills.entries.browser-use.apiKey "bu_your_key_here"
> ```

Base URL: `https://api.browser-use.com/api/v2`

All requests need header: `X-Browser-Use-API-Key: <apiKey>`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation encourages use of persisted profiles to keep users logged in, but it does not warn that these profiles may contain long-lived cookies and authenticated session state. In a cloud-browser context, that can unintentionally broaden access to user accounts and increase the blast radius if a session, profile, or API key is misused.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# With profile (recommended - keeps you logged in)
curl -X POST "https://api.browser-use.com/api/v2/browsers" \
  -H "X-Browser-Use-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"profileId": "<profile-uuid>", "timeout": 60}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill claims a limited scope focused on browser sessions and browser-task automation, but the API reference explicitly points operators toward broader Browser Use capabilities such as Files, Skills, and Skills Marketplace. That scope expansion can lead users or downstream agents to interact with unrelated high-risk surfaces without any guardrails, review, or least-privilege guidance.

Static analysis

No suspicious patterns detected.