Security audit

Agent Browser

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate browser automation skill, but it gives an agent powerful authenticated browsing, cookie, JavaScript, recording, upload, and proxy capabilities with weak safety boundaries.

Install only if you trust inference.sh and need high-capability browser automation. Use it only on sites and accounts you are authorized to automate, avoid exporting or logging cookies, review any JavaScript before execution, keep recordings off around sensitive pages, upload only approved files, use trusted proxies, avoid rate-limit evasion, and close sessions promptly.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The documentation states that the shown approach can retrieve httpOnly cookies, but the provided JavaScript cannot do that. This is dangerous because users may rely on incorrect security assumptions, build tooling that mishandles session material, or attempt broader cookie exfiltration in authenticated browser sessions under the false belief that the example is sanctioned and complete.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The manifest advertises very broad trigger phrases such as browser, scrape, click, browse web, and research, which are common across many benign user requests. In an agent ecosystem that auto-selects skills by trigger text, this can cause the browser automation skill to activate in more situations than intended, exposing powerful capabilities like navigation, file upload, proxy use, and JavaScript execution without an explicit user decision.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill documentation presents sensitive browser actions as routine usage but does not prominently warn about privacy, credential handling, external navigation, downloads/uploads, proxy routing, or execution of arbitrary page JavaScript. Because this skill can automate logins, upload local files, browse authenticated sessions, and run code in page context, missing user-facing safeguards increases the chance of unintended data disclosure or harmful actions when invoked by an agent.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The cookie extraction section encourages exporting authenticated cookies and echoing them to stdout without a prominent warning that this exposes session tokens to logs, shell history, CI output, and downstream tools. In the context of a browser automation skill that maintains authenticated sessions, this materially increases the risk of session hijacking and unauthorized account access if the output is captured or reused insecurely.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation explicitly exposes an `execute` function that runs arbitrary JavaScript in the context of whatever page the agent has loaded, but it provides no warning about security boundaries, trust assumptions, or data-handling risks. In an agent-browsing skill, this can enable unsafe extraction of page data, unintended interaction with authenticated sessions, or execution of powerful DOM/API calls on sensitive sites if an agent is induced to use it blindly.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The `open` command documents `proxy_username` and `proxy_password` as JSON CLI inputs without any warning that secrets placed directly on the command line may be exposed via shell history, process listings, logs, or transcripts. Because this skill is meant for agent use and examples encourage inline JSON, the context increases the likelihood that users or agents will handle credentials insecurely.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The authenticated proxy example demonstrates passing proxy credentials directly into command input without an explicit warning about secret handling, shell history exposure, logging, and accidental disclosure in docs or transcripts. In an agent-browser skill, proxy credentials may grant access to internal egress infrastructure or monitored corporate networks, so normalizing this pattern increases the chance of credential leakage and downstream network abuse.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The 'Rate Limit Avoidance' section explicitly frames proxy rotation as a way to bypass rate limits while scraping, which can facilitate evasion of service protections, policy violations, and higher-impact automated collection. Because this skill is a browser automation capability with scraping and JavaScript execution, the guidance materially lowers the barrier to abusive automation and can be repurposed for stealthier mass collection or anti-abuse circumvention.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The privacy/anonymity example suggests that routing traffic through a proxy provides anonymity, but omits that proxy operators can observe traffic metadata or content and that anonymity is not guaranteed. In the context of an agent-controlled browser, this can mislead users into sending sensitive browsing activity through untrusted intermediaries, creating confidentiality and compliance risks.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation explicitly states that sessions persist cookies, storage, history, and page state across calls, but it does not warn users that this can retain authentication tokens and sensitive site data. In an agent-driven browser skill, this increases the risk of accidental cross-task data exposure, misuse of authenticated sessions, or unintended actions performed under a prior login context.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The parallel sessions guidance promotes multi-site scraping, load testing, and cross-region testing without warning about consent, rate limiting, terms-of-service, privacy, or operational impact on target sites. In a browser automation skill, these examples can normalize high-volume or geographically distributed collection behavior that may cause legal, ethical, or service abuse issues.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This documentation explicitly advises users to bypass the safer ref-based interaction model and run arbitrary page JavaScript when an element is not directly available. In a browser-automation skill, normalizing arbitrary JS execution increases the likelihood that agents will execute unsafe, brittle, or policy-bypassing code against untrusted pages, which can lead to data exposure, unintended actions, or circumvention of security boundaries.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The recording guidance encourages enabling browser video without an upfront warning that the capture includes everything visible in the session, including credentials, personal data, tokens shown in pages, and other sensitive content. In a browser automation skill, this is particularly risky because the tool is explicitly used for form filling, admin workflows, and web research, so users may unknowingly create sensitive recordings that persist on disk or get shared.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The examples for documentation generation, CI artifacts, and audit archiving normalize saving and distributing recordings without warning about privacy, data minimization, access control, or tamper/integrity considerations. Because these workflows may involve internal apps, admin panels, and automated tests, the resulting videos could expose sensitive UI state or user data to artifact stores, shared documentation, or long-term archives.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.