Security audit

Agent Browser

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate browser automation helper, but its install path and examples expose users to avoidable risks around remote code execution, credentials, cookies, proxies, screenshots, and recordings.

Install only after reviewing the inference.sh CLI installer through a verified manual path, avoid optional unpinned related skills unless you trust and pin them, and treat any credentials, cookies, screenshots, videos, uploads, proxy details, and session IDs used with this skill as sensitive data sent through a hosted browser workflow. Use test accounts where possible, close sessions promptly, do not export or print cookies, and avoid running it on private or regulated sites without explicit authorization.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:17
Finding: Mutable Remote Installer Is Executed Directly Through the Shell
Content: View full analysis
Remediation: View remediation
/infsh-.tar.gz ``` 4. Verify the artifact locally against a digest embedded in the reviewed Skill rather than downloading both the artifact and expected digest from the same mutable source: ```bash printf '%s %s\n' '' 'infsh.tar.gz' | sha256sum --check - ``` 5. Prefer a cryptographic signature verified with a pinned, independently distributed public key. 6. Extract and install only after verification succeeds. 7. Avoid requiring elevated permissions; install into a user-controlled directory with restricted permissions. 8. Document the binary's network destinations, update behavior, credential storage, and supported manual removal procedure. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/authentication.md:31
Finding: Authentication and Proxy Secrets Are Embedded in Command-Line JSON
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/authentication.md:209
Finding: Authenticated Session Cookies Are Printed to Standard Output
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:273
Finding: Related Skills Are Installed from Mutable, Unpinned Sources
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: templates/authenticated-session.sh:38
Finding: Shell Values Are Concatenated into JSON Without Correct Escaping
Content: View full analysis
Remediation: View remediation
/dev/null <<<"$INPUT" ``` 7. Avoid logging generated payloads when they may contain credentials or private form data. 8. Add tests covering quotes, backslashes, Unicode, newlines, and attempted injected fields. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: curl -fsSL https://cli.inference.sh | sh executes remote network content directly in the shell, creating a classic supply-chain and remote code execution risk if the endpoint, transport, or distribution pipeline is compromised. Although the text later mentions checksum verification, the one-line install command still normalizes unsafe execution behavior and may bypass careful manual verification by users.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
bash
# Install CLI curl -fsSL https://cli.inference.sh | sh && infsh login # Open a page and get interactive elements infsh app run agent-browser --function open --input '{"url": "https://example.com"}' --session new

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description contains very broad trigger phrases such as browser, scrape, browse web, and research, which can cause this powerful skill to activate for many common user requests. Because the skill enables web automation, file upload, JavaScript execution, proxies, and recording, overbroad invocation increases the chance of unintended use on sensitive tasks or data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill advertises sensitive capabilities—web scraping, file upload, proxying, JavaScript execution, session persistence, screenshots, and video recording—without clear privacy and safety warnings. In context, that omission is significant because users or downstream agents may unknowingly expose credentials, personal data, internal files, or browsing artifacts during automated sessions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation explicitly demonstrates extracting cookies from an authenticated browser session and reusing them in other tools, but it does not clearly warn that session cookies are bearer tokens that can enable full account hijacking if exposed. In the context of a browser automation skill that handles login, OAuth, and 2FA flows, this materially increases the chance that users will export sensitive authentication artifacts into logs, shells, downstream tools, or insecure storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This command reference documents powerful browser automation capabilities that can access page contents, fill forms, upload files, take screenshots, record video, and execute arbitrary JavaScript, but it provides no warnings about handling credentials, personal data, internal sites, or other sensitive browser state. In an agent-facing skill, that omission increases the chance that an agent or operator will use the tool in unsafe contexts and unintentionally capture or exfiltrate sensitive information from authenticated sessions or local files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation shows proxy credentials being passed directly into browser session configuration without clearly warning that the proxy operator can observe traffic metadata and may receive authentication material depending on protocol and deployment. In a browser-automation skill, users may copy this pattern into production workflows and expose sensitive corporate or personal credentials to untrusted proxy infrastructure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The rate-limit avoidance example normalizes rotating proxies for scraping without warning about terms-of-service violations, privacy risks, or the potential to evade anti-abuse controls. In the context of an agent browser with scraping and JavaScript execution, this can facilitate abusive collection or concealment of origin, increasing misuse potential.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The privacy/anonymity section implies that a proxy provides anonymity but does not warn that proxies do not guarantee anonymity and instead transfer trust to the proxy provider. For a browser automation skill, this can mislead users into exposing browsing activity, session data, or identifying metadata under a false sense of privacy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation explicitly encourages persistent browser sessions that retain cookies, local/session storage, history, page state, and optional video recordings, but it does not warn users that these artifacts may contain credentials, personal data, or other sensitive session material. In a browser automation skill, this omission is security-relevant because users may unknowingly reuse or mishandle session IDs and recorded artifacts, increasing the risk of account takeover, data exposure, or privacy violations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The documentation explicitly demonstrates filling a password field and submitting a login form using a literal example password, but provides no warning about handling real credentials, secret redaction, or avoiding storage/logging of sensitive inputs. In an agent-browser skill, this is materially risky because agents may replay these patterns against real services and expose credentials in prompts, shell history, logs, screenshots, or execution traces.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file recommends using JavaScript to interact with elements when normal refs do not work, but gives no warning that arbitrary page-side script execution can trigger unintended actions, bypass safety assumptions, exfiltrate page data, or interact with hidden elements outside the constrained snapshot model. In the context of a browser automation skill that already supports navigation, form filling, and file upload, encouraging unrestricted JS execution significantly increases the chance of unsafe or abusive automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The template instructs users to place login credentials in environment variables (APP_USERNAME and APP_PASSWORD) but does not warn about secret-handling risks such as shell history exposure, process/environment leakage to child processes, CI log disclosure, or accidental persistence in terminal/session configs. In a browser automation skill that performs authenticated sessions, this increases the chance that real account credentials are handled insecurely during routine use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This workflow intentionally captures screenshots, full-page images, visible text, links, and optionally session video from arbitrary URLs, then writes all of that data to local disk. In a browser automation skill, that can easily collect secrets, personal data, internal documents, or authenticated content without any guardrails, confirmation, redaction, or retention controls, so the privacy and data-handling risk is real even if the script is meant for legitimate scraping and research.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This template explicitly scaffolds automated form submission to arbitrary external URLs and encourages populating fields from environment variables, but it provides no warning that the data may be transmitted to third-party sites and persisted remotely. In the context of a browser automation skill, that omission materially increases the risk of accidental exfiltration of personal data, credentials, or other sensitive form contents during routine agent use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The parallel session examples promote multi-site scraping and multi-user simulation without any reminder to respect site terms, authorization boundaries, rate limits, or privacy constraints. In the context of an agent browser skill designed for scraping and automation, this can normalize unsafe use patterns and lead to unauthorized collection or excessive automated access, though the issue is primarily missing safety guidance rather than an active exploit primitive.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.