Use Browser (Scrape leads, like, post on socials or perform actions on the web)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:16 AM UTC
• Version: 1.0.0

Overview

The skill is not overtly malicious, but it gives an agent broad control over authenticated social media accounts without enough confirmation for public actions, outreach, scraping, or cookie handling.

Install only if you are comfortable with an agent acting inside authenticated social media accounts. Before using it, require explicit previews and confirmations for posts, DMs, connection requests, engagement, scraping/export jobs, and all cookie commands; avoid high-value accounts and do not let exported cookies remain on disk.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:231
• Finding: Authenticated Session Cookies Can Be Read and Exported## Vulnerability Details **File Location**: `SKILL.md`, lines 231–245 **Vulnerability Type**: Authentication cookie exposure and insecure credential export **Risk Level**: Medium ### Vulnerable Code ```bash browser-use cookies get # Get all cookies for current session browser-use cookies get --url https://instagram.com # Cookies for specific platform browser-use cookies set <name> <value> # Set a cookie browser-use cookies set name val --domain .instagram.com --secure --http-only browser-use cookies clear --url <url> # Clear cookies for specific URL browser-use cookies export <file> # Export cookies to JSON browser-use cookies import <file> # Import cookies from JSON ``` ```text **Cookie rules:** - Cookie export files should be stored in `~/.browseruse/cookies/`, not in `/tmp/` or world-readable locations - After importing cookies, delete the export file: `rm <file>` - Never export cookies from one platform and import them into a different platform's session - If a session expires, inform the user so they can re-authenticate manually ``` ### Technical Analysis The Skill permits the agent to retrieve authentication cookies into command output and export them as JSON to a caller-selected file. Social-media session cookies are bearer credentials: possession may be sufficient to impersonate the authenticated user without knowing the account password. The documented storage guidance does not technically enforce a fixed destination, restrictive file permissions, encryption, redaction from model context or logs, user confirmation, or automatic deletion. The deletion instruction applies only after an import, so an export created for another reason may remain on disk indefinitely. These capabilities are also unnecessary for most documented workflows, which can rely on browser-managed persistent sessions. ### Attack Path ...[truncated 1329 chars]
• Remediation: ## Remediation Suggestions 1. Remove `cookies get`, `cookies export`, and `cookies import` from the normal Skill interface when browser-managed session persistence is sufficient. 2. Require explicit, operation-specific user confirmation before reading, exporting, importing, setting, or clearing cookies. 3. Never return raw cookie values to the model context, terminal history, telemetry, or ordinary application logs. 4. If export is indispensable, enforce a fixed private directory rather than accepting arbitrary output paths. 5. Create export files atomically with owner-only permissions such as mode `0600`, reject symbolic links, and verify directory ownership and permissions. 6. Encrypt exported credentials at rest using a user-controlled secret or operating-system credential store. 7. Automatically delete exports immediately after the authorized operation, including failure and cancellation paths. 8. Restrict exports to the minimum required domains and cookie fields, and prevent transfer between accounts, platforms, or sessions. 9. Record security events without recording cookie names or values, and provide a session-revocation procedure for suspected exposure. 10. Treat cookie clear/import operations as account-impacting actions that require confirmation and post-operation verification.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly supports lead scraping and profile data extraction from social platforms but does not include guardrails for privacy, consent, data minimization, retention, or legal/terms-of-service constraints. In a social-media automation context, this creates a realistic risk of collecting personal data at scale without user awareness of compliance obligations, making misuse easier even if the author’s intent appears operational rather than malicious.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill allows the agent to send DMs, connection requests, likes, comments, and publish posts without requiring an explicit user warning that these actions create external account activity under the user’s authenticated identity. Because the VM reuses pre-authenticated sessions, mistaken, injected, or over-broad instructions can directly affect third-party accounts and recipients, causing reputational, legal, or platform-enforcement harm.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

The agent operates with **high autonomy** for standard social media tasks, but MUST pause and confirm with the user before destructive or irreversible actions.

### ✅ Act Freely (No Confirmation Needed)

- Posting and publishing content (text, images, stories)
- Sending DMs and connection requests

• Confidence: 96% confidence
• Finding: Granting 'high autonomy' and marking posting, DMs, connection requests, engagement, and scraping as actions the agent may perform freely is unsafe in this context. Even though destructive actions require confirmation, many non-destructive actions are still externally consequential and can be abused by prompt injection, user misunderstanding, or task misinterpretation to perform large-scale account activity or data collection.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

```

**Cookie rules:**
- Cookie export files should be stored in `~/.browseruse/cookies/`, not in `/tmp/` or world-readable locations
- After importing cookies, delete the export file: `rm <file>`
- Never export cookies from one platform and import them into a different platform's session
- If a session expires, inform the user so they can re-authenticate manually

• Confidence: 70% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Static analysis

No suspicious patterns detected.