Agent Browser

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:20 AM UTC
• Version: 0.1.5

Overview

The skill is a legitimate browser automation helper, but its install path and examples expose users to avoidable risks around remote code execution, credentials, cookies, proxies, screenshots, and recordings.

Install only after reviewing the inference.sh CLI installer through a verified manual path, avoid optional unpinned related skills unless you trust and pin them, and treat any credentials, cookies, screenshots, videos, uploads, proxy details, and session IDs used with this skill as sensitive data sent through a hosted browser workflow. Use test accounts where possible, close sessions promptly, do not export or print cookies, and avoid running it on private or regulated sites without explicit authorization.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:17
• Finding: Mutable Remote Installer Is Executed Directly Through the Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash # Install CLI curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The installation command downloads a shell script from a mutable external URL and sends the response directly to `sh`. The effective code being executed is therefore not contained in the audited project and can change after the Skill has been reviewed. Although `SKILL.md:23` states that the installer verifies the checksum of a subsequently downloaded binary, this does not establish trust in the installer itself. The installer is executed before its contents, version, signature, or digest are independently verified. Any checksum logic inside that script can also be modified if the remote installer is compromised. HTTPS protects transport under ordinary conditions, but it does not mitigate compromise of the hosting account, web server, DNS or certificate infrastructure, deployment pipeline, or the installer itself. ### Attack Path 1. An attacker compromises `cli.inference.sh`, its deployment pipeline, or another component capable of changing the returned installer. 2. The attacker replaces or modifies the installer response with malicious shell commands. 3. A user or Agent follows the documented Quick Start command. 4. `curl` retrieves the attacker-controlled response. 5. The pipe sends the response directly to `sh` without local verification. 6. The malicious commands execute with all operating-system privileges held by the invoking user. ### Impact Assessment Successful exploitation permits arbitrary local command execution under the invoking account. Depending on that account's existing permissions, an attacker could: - Read or modify user-accessible files and credentials. - Steal authentication tokens and environment variables. - Install persistence within user- ...[truncated 431 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | sh` installation path. 2. Publish versioned CLI artifacts and require an explicit immutable version. 3. Download the artifact to a temporary file without executing it: ```bash curl --fail --show-error --location \ --output infsh.tar.gz \ https://dist.inference.sh/cli/releases/<fixed-version>/infsh-<platform>.tar.gz ``` 4. Verify the artifact locally against a digest embedded in the reviewed Skill rather than downloading both the artifact and expected digest from the same mutable source: ```bash printf '%s %s\n' '<reviewed-sha256>' 'infsh.tar.gz' | sha256sum --check - ``` 5. Prefer a cryptographic signature verified with a pinned, independently distributed public key. 6. Extract and install only after verification succeeds. 7. Avoid requiring elevated permissions; install into a user-controlled directory with restricted permissions. 8. Document the binary's network destinations, update behavior, credential storage, and supported manual removal procedure. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/authentication.md:31
• Finding: Authentication and Proxy Secrets Are Embedded in Command-Line JSON<![CDATA[ ## Vulnerability Details **File Locations**: - `references/authentication.md:31-38` - `references/authentication.md:99-102` - `references/authentication.md:133-139` - `references/proxy-support.md:35-40` - `references/proxy-support.md:137-142` - `templates/authenticated-session.sh:76-87` **Vulnerability Type**: Sensitive information exposure through command arguments and a hosted browser service **Risk Level**: High ### Vulnerable Code From `references/authentication.md`: ```bash # Fill credentials infsh app run agent-browser --function interact --session $SESSION --input '{ "action": "fill", "ref": "@e1", "text": "[e-mail]" }' infsh app run agent-browser --function interact --session $SESSION --input '{ "action": "fill", "ref": "@e2", "text": "'"$PASSWORD"'" }' ``` ```bash # Fill password infsh app run agent-browser --function interact --session $SESSION --input '{ "action": "fill", "ref": "@e1", "text": "'"$GOOGLE_PASSWORD"'" }' ``` ```bash TOTP_CODE=$(oathtool --totp -b "$TOTP_SECRET") # Fill 2FA code infsh app run agent-browser --function interact --session $SESSION --input '{ "action": "fill", "ref": "@e1", "text": "'"$TOTP_CODE"'" }' ``` From `references/proxy-support.md`: ```bash SESSION=$(infsh app run agent-browser --function open --session new --input '{ "url": "https://external-vendor.com", "proxy_url": "http://corpproxy.company.com:8080", "proxy_username": "'"$CORP_USER"'", "proxy_password": "'"$CORP_PASS"'" }' | jq -r '.session_id') ``` From `templates/authenticated-session.sh`: ```bash infsh app run agent-browser --function interact --session $SESSION_ID --input '{ "action": "fill", "ref": "@e1", "text": "'"$APP_USERNAME"'" }' infsh app run agent-browser --function interact --session $SESSION_ID --input '{ "action": "fill", "ref": "@e2", "text": "'"$APP_PASSWORD"'" }' ``` ### Technical Analysis The examples expand passwords, TOTP codes, usernames, and proxy credentials directly into the value pas ...[truncated 2324 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not place secrets in command-line arguments. 2. Extend the CLI to accept sensitive fields through protected standard input, a dedicated file descriptor, an operating-system credential facility, or a documented secret-provider integration. 3. If a temporary secret file is unavoidable: - Create it with mode `0600`. - Store it in a private directory. - Avoid predictable names. - Delete it immediately after use. 4. Ensure examples disable shell tracing before handling secrets: ```bash set +x ``` This is only defense in depth and does not fix argv exposure. 5. Use short-lived, task-scoped test accounts rather than personal or administrative identities. 6. Avoid automating a primary Google or enterprise identity-provider password unless explicitly required and approved. 7. Prefer manual or delegated authentication mechanisms in which the hosted automation service does not receive the reusable password. 8. Require explicit user consent before sending credentials to a third-party hosted browser. 9. Document the service's encryption, retention, deletion, employee-access, tenancy-isolation, and regional-processing controls. 10. Redact sensitive fields from CLI logs, errors, telemetry, and Agent transcripts. 11. Rotate any credential suspected of having appeared in process logs or automation output. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/authentication.md:209
• Finding: Authenticated Session Cookies Are Printed to Standard Output<![CDATA[ ## Vulnerability Details **File Location**: `references/authentication.md:209-219` **Vulnerability Type**: Plaintext disclosure of bearer session credentials **Risk Level**: High ### Vulnerable Code ```bash ## Cookie Extraction Extract cookies for use in other tools: ```bash # Get cookies via JavaScript RESULT=$(infsh app run agent-browser --function execute --session $SESSION --input '{ "code": "document.cookie" }') COOKIES=$(echo $RESULT | jq -r '.result') echo "Cookies: $COOKIES" ``` ``` ### Technical Analysis The documented workflow reads JavaScript-accessible cookies from an authenticated browser and prints them to standard output. Authentication cookies commonly function as bearer credentials: possession may be sufficient to impersonate the authenticated user without knowing the password. Standard output is frequently retained in terminal scrollback, Agent transcripts, CI logs, shell-session capture, centralized logging, or monitoring platforms. The guidance presents printing as a normal extraction workflow rather than limiting it to a protected transfer mechanism. The following text in `references/authentication.md:221-225` also claims to obtain all cookies, including `httpOnly` cookies, but the corresponding JavaScript only enumerates resource URLs. That claim is inaccurate and should not be relied on as a security capability. ### Attack Path 1. The user establishes an authenticated remote browser session. 2. The Skill invokes JavaScript to obtain `document.cookie`. 3. The remote service returns JavaScript-accessible cookie values. 4. The shell stores those values in `COOKIES`. 5. `echo "Cookies: $COOKIES"` writes the bearer credentials to standard output. 6. A person or system with access to terminal history, CI output, Agent transcripts, or centralized logs retrieves the values. 7. The attacker supplies still-valid cookies to the target application and impersonates the user. ### Impact Assessment Successful exploitation may pe ...[truncated 495 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the example that prints cookies to standard output. 2. Require a specific, documented use case before permitting cookie export. 3. Transfer cookies only to an explicitly authorized local consumer through secure IPC or a mode-`0600` file. 4. Never include cookie values in terminal output, Agent responses, debug logs, CI logs, or telemetry. 5. Redact `Cookie`, `Set-Cookie`, authorization headers, and session identifiers from all service responses and diagnostic output. 6. Use short-lived sessions and close the remote browser immediately after completing the task. 7. Revoke or invalidate exported sessions after use. 8. Correct or remove the inaccurate statement that the resource-URL expression retrieves `httpOnly` cookies. 9. Prefer scoped application APIs and short-lived API tokens over exporting browser session cookies. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:273
• Finding: Related Skills Are Installed from Mutable, Unpinned Sources<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:273-278` **Vulnerability Type**: Unpinned third-party Skill dependency **Risk Level**: Medium ### Vulnerable Code ```bash ## Related Skills ```bash # Web search (for research + browse) npx skills add inference-sh/skills@web-search # LLM models (analyze extracted content) npx skills add inference-sh/skills@llm-models ``` ``` ### Technical Analysis The documentation recommends installing additional Skills through `npx` using mutable source identifiers. The commands do not specify an immutable package version, commit hash, content digest, or verified signature. Consequently, the content installed when a user runs these commands may differ from the content that existed when this project was audited. A compromised publisher account, package registry, source repository, dependency, or release pipeline could introduce malicious code or instructions. The related Skills are optional rather than required for the declared browser automation functionality. Installing them therefore expands the dependency and instruction trust boundary beyond the minimum necessary scope. ### Attack Path 1. An attacker compromises an upstream publisher, repository, package, or release pipeline associated with one of the referenced Skills. 2. The attacker publishes modified Skill content under the same mutable identifier. 3. A user follows the Related Skills installation instructions. 4. `npx skills add` resolves and installs the current attacker-controlled content. 5. The newly installed Skill executes malicious code or introduces malicious Agent instructions when invoked or loaded. ### Impact Assessment Impact depends on the permissions granted to the installed Skill. Potential consequences include: - Execution of commands available to that Skill. - Access to files, credentials, or network services exposed to the Agent. - Instruction hijacking within sessions that load the dependency. - Further dependency installa ...[truncated 275 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove optional installation commands from the primary workflow unless the additional Skills are necessary. 2. Pin every dependency to an immutable release and commit hash or content digest. 3. Verify signatures or checksums before enabling downloaded Skill content. 4. Maintain an allowlist of audited dependency versions. 5. Review the complete transitive dependency and instruction set before installation. 6. Prevent automatic updates from replacing an audited version without another security review. 7. Document the permissions and data access required by each related Skill. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: templates/authenticated-session.sh:38
• Finding: Shell Values Are Concatenated into JSON Without Correct Escaping<![CDATA[ ## Vulnerability Details **File Locations**: - `templates/authenticated-session.sh:38-41,76-87` - `templates/form-automation.sh:28-31,65-84` - `templates/capture-workflow.sh:50-57` **Vulnerability Type**: Improper generation of structured command input **Risk Level**: Medium ### Vulnerable Code From `templates/authenticated-session.sh`: ```bash RESULT=$(infsh app run agent-browser --function open --session new --input '{ "url": "'"$LOGIN_URL"'" }') ``` ```bash infsh app run agent-browser --function interact --session $SESSION_ID --input '{ "action": "fill", "ref": "@e1", "text": "'"$APP_USERNAME"'" }' infsh app run agent-browser --function interact --session $SESSION_ID --input '{ "action": "fill", "ref": "@e2", "text": "'"$APP_PASSWORD"'" }' ``` From `templates/form-automation.sh`: ```bash RESULT=$(infsh app run agent-browser --function open --session new --input '{ "url": "'"$FORM_URL"'" }') ``` ```bash # Text input infsh app run agent-browser --function interact --session $SESSION_ID --input '{ "action": "fill", "ref": "@e1", "text": "'"${FORM_NAME:-John Doe}"'" }' # Email input infsh app run agent-browser --function interact --session $SESSION_ID --input '{ "action": "fill", "ref": "@e2", "text": "'"${FORM_EMAIL:[e-mail]}"'" }' ``` From `templates/capture-workflow.sh`: ```bash RESULT=$(infsh app run agent-browser --function open --session new --input '{ "url": "'"$TARGET_URL"'", "record_video": '$RECORD_VIDEO', "width": 1920, "height": 1080 }') ``` ### Technical Analysis The templates generate JSON by ending a single-quoted shell string, inserting a variable, and then reopening the quoted string. Shell quoting protects the expanded value from ordinary word splitting in these particular argument constructions, but it does not JSON-escape the value. A value containing a double quote, backslash, newline, or another JSON-significant character can therefore: - Make the payload invalid. - Terminate the intend ...[truncated 1909 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Stop constructing JSON through shell-string concatenation. 2. Use `jq` or another real JSON serializer for every dynamic field: ```bash INPUT=$(jq -n --arg url "$LOGIN_URL" '{url: $url}') RESULT=$(infsh app run agent-browser \ --function open \ --session new \ --input "$INPUT") ``` 3. Build credential-bearing payloads in the same way, while also moving secrets out of command-line arguments: ```bash INPUT=$(jq -n \ --arg ref '@e2' \ --arg text "$APP_PASSWORD" \ '{action: "fill", ref: $ref, text: $text}') ``` 4. Validate URL schemes and permit only explicitly required protocols, normally `https`. 5. Reject embedded control characters where they are not required. 6. Validate all generated JSON before invoking the remote service: ```bash jq -e . >/dev/null <<<"$INPUT" ``` 7. Avoid logging generated payloads when they may contain credentials or private form data. 8. Add tests covering quotes, backslashes, Unicode, newlines, and attempted injected fields. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Install CLI
curl -fsSL https://cli.inference.sh | sh && infsh login

# Open a page and get interactive elements
infsh app run agent-browser --function open --input '{"url": "https://example.com"}' --session new

• Confidence: 99% confidence
• Finding: `curl -fsSL https://cli.inference.sh | sh` executes remote network content directly in the shell, creating a classic supply-chain and remote code execution risk if the endpoint, transport, or distribution pipeline is compromised. Although the text later mentions checksum verification, the one-line install command still normalizes unsafe execution behavior and may bypass careful manual verification by users.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The manifest description contains very broad trigger phrases such as browser, scrape, browse web, and research, which can cause this powerful skill to activate for many common user requests. Because the skill enables web automation, file upload, JavaScript execution, proxies, and recording, overbroad invocation increases the chance of unintended use on sensitive tasks or data.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill advertises sensitive capabilities—web scraping, file upload, proxying, JavaScript execution, session persistence, screenshots, and video recording—without clear privacy and safety warnings. In context, that omission is significant because users or downstream agents may unknowingly expose credentials, personal data, internal files, or browsing artifacts during automated sessions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly demonstrates extracting cookies from an authenticated browser session and reusing them in other tools, but it does not clearly warn that session cookies are bearer tokens that can enable full account hijacking if exposed. In the context of a browser automation skill that handles login, OAuth, and 2FA flows, this materially increases the chance that users will export sensitive authentication artifacts into logs, shells, downstream tools, or insecure storage.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This command reference documents powerful browser automation capabilities that can access page contents, fill forms, upload files, take screenshots, record video, and execute arbitrary JavaScript, but it provides no warnings about handling credentials, personal data, internal sites, or other sensitive browser state. In an agent-facing skill, that omission increases the chance that an agent or operator will use the tool in unsafe contexts and unintentionally capture or exfiltrate sensitive information from authenticated sessions or local files.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation shows proxy credentials being passed directly into browser session configuration without clearly warning that the proxy operator can observe traffic metadata and may receive authentication material depending on protocol and deployment. In a browser-automation skill, users may copy this pattern into production workflows and expose sensitive corporate or personal credentials to untrusted proxy infrastructure.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The rate-limit avoidance example normalizes rotating proxies for scraping without warning about terms-of-service violations, privacy risks, or the potential to evade anti-abuse controls. In the context of an agent browser with scraping and JavaScript execution, this can facilitate abusive collection or concealment of origin, increasing misuse potential.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The privacy/anonymity section implies that a proxy provides anonymity but does not warn that proxies do not guarantee anonymity and instead transfer trust to the proxy provider. For a browser automation skill, this can mislead users into exposing browsing activity, session data, or identifying metadata under a false sense of privacy.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly encourages persistent browser sessions that retain cookies, local/session storage, history, page state, and optional video recordings, but it does not warn users that these artifacts may contain credentials, personal data, or other sensitive session material. In a browser automation skill, this omission is security-relevant because users may unknowingly reuse or mishandle session IDs and recorded artifacts, increasing the risk of account takeover, data exposure, or privacy violations.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation explicitly demonstrates filling a password field and submitting a login form using a literal example password, but provides no warning about handling real credentials, secret redaction, or avoiding storage/logging of sensitive inputs. In an agent-browser skill, this is materially risky because agents may replay these patterns against real services and expose credentials in prompts, shell history, logs, screenshots, or execution traces.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The file recommends using JavaScript to interact with elements when normal refs do not work, but gives no warning that arbitrary page-side script execution can trigger unintended actions, bypass safety assumptions, exfiltrate page data, or interact with hidden elements outside the constrained snapshot model. In the context of a browser automation skill that already supports navigation, form filling, and file upload, encouraging unrestricted JS execution significantly increases the chance of unsafe or abusive automation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The template instructs users to place login credentials in environment variables (APP_USERNAME and APP_PASSWORD) but does not warn about secret-handling risks such as shell history exposure, process/environment leakage to child processes, CI log disclosure, or accidental persistence in terminal/session configs. In a browser automation skill that performs authenticated sessions, this increases the chance that real account credentials are handled insecurely during routine use.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This workflow intentionally captures screenshots, full-page images, visible text, links, and optionally session video from arbitrary URLs, then writes all of that data to local disk. In a browser automation skill, that can easily collect secrets, personal data, internal documents, or authenticated content without any guardrails, confirmation, redaction, or retention controls, so the privacy and data-handling risk is real even if the script is meant for legitimate scraping and research.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This template explicitly scaffolds automated form submission to arbitrary external URLs and encourages populating fields from environment variables, but it provides no warning that the data may be transmitted to third-party sites and persisted remotely. In the context of a browser automation skill, that omission materially increases the risk of accidental exfiltration of personal data, credentials, or other sensitive form contents during routine agent use.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The parallel session examples promote multi-site scraping and multi-user simulation without any reminder to respect site terms, authorization boundaries, rate limits, or privacy constraints. In the context of an agent browser skill designed for scraping and automation, this can normalize unsafe use patterns and lead to unauthorized collection or excessive automated access, though the issue is primarily missing safety guidance rather than an active exploit primitive.

Static analysis

No suspicious patterns detected.