Browser Automation 1

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:08 AM UTC
• Version: 1.0.0

Overview

The skill’s browser automation purpose is clear, but it grants broad web, local-network, persistent-session, download, and screenshot capabilities without enough scoping or user-control guidance.

Install only if you are comfortable isolating this browser automation environment. Use a dedicated temporary browser profile, avoid real credentials unless necessary, delete profile/screenshots/downloads after sensitive tasks, avoid internal or localhost targets unless explicitly intended, and treat downloaded files and model-backed page extraction as potentially exposing sensitive data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: REFERENCE.md:458
• Finding: Persistent Browser Profile Retains Passwords and Authenticated Sessions## Vulnerability Details **File Location**: `REFERENCE.md:458-459` (also documented at `REFERENCE.md:16, 315, 374` and `EXAMPLES.md:114, 144`) **Vulnerability Type**: Persistent storage of sensitive authentication data **Risk Level**: High ### Vulnerable Code or Configuration ```text ### Credential Handling - Browser uses persistent profile (`.chrome-profile/`) - Saved passwords and cookies persist between sessions - Consider using isolated profiles for sensitive operations ``` The cleanup behavior explicitly preserves this profile: ```text - Does NOT delete `.chrome-profile/` directory (preserved for reuse) ``` The documented login workflow enters a password into this persistent browser environment: ```bash browser act "Fill in the password field with 'mypassword'" ``` ### Technical Analysis The browser is launched with `.chrome-profile/` as a persistent user-data directory. Authentication cookies, site storage, browsing history, and potentially saved passwords therefore survive browser termination. The `close` operation does not delete the profile. This violates least-retention principles for automation that may process credentials. Data is retained in a predictable relative path and may be reused by later invocations. Any subsequent process or automation task with access to the project directory and browser profile could potentially recover browser-state data or launch Chrome with the same authenticated sessions. The documentation recommends isolated profiles for sensitive operations, but isolation is not the documented default and no automatic expiration, permission hardening, encryption, or secure deletion is described. ### Attack Path 1. A user invokes the Skill to authenticate to a website. 2. The automation enters the user's password and receives an authenticated session cookie. 3. Chrome stores session data in `.chrome-profile/`. 4. The user invokes `browser close`, but the profile remai ...[truncated 727 chars]
• Remediation: ## Remediation Suggestions - Create a unique, randomly named temporary Chrome profile for each automation task. - Delete the temporary profile during normal cleanup and in error-handling or termination hooks. - Make persistent sessions opt-in and require explicit user confirmation. - Disable browser password saving and credential autofill for automation profiles. - Restrict profile-directory permissions to the current operating-system user. - Never place profiles containing credentials in shared workspaces or source-control directories. - Provide a dedicated command that securely clears cookies, local storage, caches, and profile data. - Document that `browser close` does not log users out, and recommend server-side session revocation after sensitive workflows. - Avoid placing plaintext passwords directly in command-line arguments because they may be retained in shell history or visible in process listings.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: REFERENCE.md:470
• Finding: Unrestricted Browser Network Access Includes Localhost and Internal Networks## Vulnerability Details **File Location**: `REFERENCE.md:470-472` **Vulnerability Type**: Missing network destination restrictions and internal-service access **Risk Level**: High ### Vulnerable Code or Configuration ```text ### Network Access - Browser has full network access - Respects system proxy settings - Can access localhost and internal networks ``` ### Technical Analysis The browser accepts user-supplied URLs and has full access to network destinations reachable from the host, including localhost and internal networks. No controls are documented for blocking loopback, private, link-local, cloud metadata, or otherwise sensitive address ranges. Browser-based access does not eliminate server-side request forgery-style risk. A browser can issue requests to internal HTTP services, display sensitive responses, submit forms, and interact with services that trust the local network. Natural-language actions and extraction capabilities may then read or manipulate the resulting pages. URL validation must account for DNS rebinding, redirects, alternate IP representations, IPv6, and hostnames that resolve to private addresses. Merely requiring an `http://` or `https://` protocol does not establish a safe trust boundary. ### Attack Path 1. An attacker influences a navigation request, natural-language instruction, or URL processed by the Skill. 2. The browser navigates to a loopback or private-network endpoint, such as a local administration interface. 3. The endpoint accepts the request because it is reachable from or trusts the local host or internal network. 4. The Skill uses screenshots, observation, extraction, or actions to inspect or interact with the internal service. 5. Sensitive internal information may be returned to the caller, or privileged operations may be performed through the browser. A related path can use an apparently public hostname that redirects to, or resolves as, a private address after init ...[truncated 567 chars]
• Remediation: ## Remediation Suggestions - Deny loopback, private, link-local, multicast, unspecified, and cloud-metadata address ranges by default for both IPv4 and IPv6. - Resolve destination hostnames before navigation and reject any result that maps to a prohibited range. - Repeat validation after redirects and protect against DNS rebinding by validating the actual connection destination. - Permit internal-network access only through an explicit, narrowly scoped allowlist and user approval. - Restrict navigation to `https://` where possible and reject unsupported URL schemes. - Run the browser in a network sandbox with outbound firewall rules rather than relying solely on application-level URL checks. - Separate public-web automation from internal-service automation using different processes, profiles, and policies. - Log attempted access to prohibited destinations without recording credentials or sensitive response data.

T09 · Insecure Skill Coding Practices

Warning

• Location: REFERENCE.md:383
• Finding: Automatic Unrestricted File Downloads to the Local Workspace## Vulnerability Details **File Location**: `REFERENCE.md:383-391` (absence of file restrictions documented at `REFERENCE.md:465`) **Vulnerability Type**: Unvalidated automatic file download **Risk Level**: Medium ### Vulnerable Code or Configuration ```typescript await client.send("Browser.setDownloadBehavior", { behavior: "allow", downloadPath: "./agent/downloads", eventsEnabled: true, }) ``` The resulting behavior is documented as: ```text **Behavior**: - Downloads start automatically (no dialog) - Files saved to `./agent/downloads/` - Download events can be monitored via CDP ``` The security considerations further state: ```text - No file type restrictions enforced ``` ### Technical Analysis Chrome is configured to allow downloads without an approval dialog and to write downloaded content into a predictable workspace directory. No file-type, MIME-type, extension, origin, size, filename, integrity, or malware-scanning restrictions are enforced. A malicious or compromised page can therefore cause attacker-controlled files to be written locally. Although the documented behavior does not itself execute those files, it creates a reliable first stage for later execution, social engineering, parser exploitation, workspace contamination, or resource exhaustion. Predictable filenames and a shared download directory can also create overwrite or file-confusion risks, depending on Chrome's filename handling and how downstream tools consume downloaded files. ### Attack Path 1. The Skill navigates to a malicious or compromised website. 2. The page initiates a download directly or in response to an automated click. 3. Chrome accepts the download without presenting a confirmation dialog. 4. The attacker-controlled file is saved under `./agent/downloads/`. 5. A user or another automation tool opens, parses, imports, or executes the downloaded file. 6. The file may exploit the downstream appli ...[truncated 599 chars]
• Remediation: ## Remediation Suggestions - Disable automatic downloads by default and require explicit user approval for each download. - Enforce allowlists for trusted origins, expected MIME types, extensions, and maximum file sizes. - Save downloads in a unique per-task quarantine directory outside executable or source-code paths. - Generate safe local filenames rather than trusting server-provided names. - Prevent path traversal, unsafe extensions, symlinks, and overwriting of existing files. - Scan downloaded content with appropriate malware and archive-scanning controls before release. - Verify cryptographic hashes or signatures when known artifacts are expected. - Apply disk quotas and limits on the number and aggregate size of downloads. - Mark downloaded files as untrusted and prevent automatic execution or parsing by downstream tools. - Delete quarantined files at the end of the task unless the user explicitly elects to retain them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: This example normalizes entering credentials and notes that Chrome profile data may persist session cookies between runs, but it does not frame this as a security risk. That combination can expose secrets, reuse authenticated sessions unintentionally, and cause cross-task data leakage if the same profile is used later by other runs or users.

Credential Access

High

• Category: Privilege Escalation

Content

"apiKey": {
      "required": true,
      "configured": false,
      "description": "ANTHROPIC_API_KEY exported (i.e $ANTHROPIC_API_KEY) or in .env file"
    },
    "browserCommand": {
      "required": true,

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"apiKey": {
      "required": true,
      "configured": false,
      "description": "ANTHROPIC_API_KEY exported (i.e $ANTHROPIC_API_KEY) or in .env file"
    },
    "browserCommand": {
      "required": true,

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The example demonstrates filling and submitting a live contact form with personal information but does not warn that the action may transmit real data to an external site. In an agent skill context, examples are often copied directly, so omission of consent, environment-safety, or test-data guidance can lead to unintended disclosure or unauthorized interaction with third-party services.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation states that files are automatically downloaded to disk but gives no warning about writing untrusted content locally. In browser automation, this can introduce malware, sensitive-data retention, storage abuse, or downstream processing of dangerous files if users assume the operation is inert.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The reference states that screenshots are taken automatically after navigation and actions, but it does not clearly warn that page contents may include sensitive information such as credentials, account data, or internal application screens. In an agent/browser automation context, silent capture to disk increases the risk of unintended data retention and later exposure through local access, logs, or artifact collection.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document says natural-language actions use Stagehand's page.act() backed by an external AI model, but it does not warn that prompts, page context, and possibly visible page content may be transmitted to that model service. Because this tool can operate on authenticated sessions and internal sites, the omission materially increases the chance that users expose sensitive data without informed consent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The extract command is described as using page.extract() with an AI model to identify and structure page data, but there is no clear disclosure that extracted page content may be processed by a model service. In this context, extraction is especially sensitive because users may target invoices, account pages, dashboards, or internal records, making silent third-party transmission a meaningful confidentiality risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation states that downloads are automatically allowed and saved to disk without user confirmation, but the warning is too weak for a feature that can write arbitrary remote content locally. In a browser automation tool with full network access, this can result in unnoticed storage of malicious, sensitive, or policy-violating files and increases the attack surface for downstream handling.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger description is extremely broad and maps to many ordinary browsing-related requests, which can cause this skill to activate in situations where browser automation is unnecessary or risky. Because the skill can interact with external sites, fill forms, and extract data, overbroad activation increases the chance of unintended web actions, privacy exposure, or silent delegation of sensitive tasks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises screenshot capture, form filling, data extraction, and web interaction but does not warn that these actions may transmit data to external sites, capture sensitive on-screen information, or alter remote state. In a browser automation context, missing privacy and side-effect warnings is materially dangerous because users may not realize that credentials, personal data, or irreversible actions could be involved.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The 'When to Use' section lists generic actions like browsing, extracting data, and clicking buttons without constraints, approval gates, or disallowed scenarios. This ambiguity makes the skill easier to invoke for broad classes of requests and increases the risk of acting on third-party websites, handling personal data, or performing unintended operations without sufficient user awareness.

Vague Triggers

Low

• Confidence: 80% confidence
• Finding: This manifest file includes a generic invocation example, "Run 'browser navigate https://example.com' from any directory to verify installation," but does not define any narrower trigger scope or exclusion conditions. In a manifest/setup context, this can contribute to ambiguous activation expectations because the command is presented as globally available and not bounded to a specific workflow beyond a single example.

Static analysis

No suspicious patterns detected.