Security audit
Security checks for vulnerabilities and agentic risk
This browser automation skill is coherent but should be reviewed because it can automatically use a remote browser, retain browser sessions, and save screenshots/downloads without clear per-task user control.
Review before installing. Use it only for sites and data you are comfortable exposing to the configured browser environment and AI provider. Prefer local-only operation for sensitive work, avoid entering real passwords through natural-language commands, clear the persistent profile when needed, and inspect or delete downloaded files and screenshots after use.
The skill silently switches to a remote Browserbase environment whenever credentials are present, while explicitly stating there is no user prompting. This can cause browsing content, session data, form inputs, screenshots, and extracted page data to be transmitted to a third-party service without the user's awareness or consent.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### First: Environment Selection (Local vs Remote)
The skill automatically selects between local and remote browser environments:
- **If Browserbase API keys exist** (BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in .env file): Uses remote Browserbase environment
- **If no Browserbase API keys**: Falls back to local Chrome browser
- **No user prompting**: The selection happens automatically based on available configuration
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### First: Environment Selection (Local vs Remote)
The skill automatically selects between local and remote browser environments:
- **If Browserbase API keys exist** (BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in .env file): Uses remote Browserbase environment
- **If no Browserbase API keys**: Falls back to local Chrome browser
- **No user prompting**: The selection happens automatically based on available configuration
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### First: Environment Selection (Local vs Remote)
The skill automatically selects between local and remote browser environments:
- **If Browserbase API keys exist** (BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in .env file): Uses remote Browserbase environment
- **If no Browserbase API keys**: Falls back to local Chrome browser
- **No user prompting**: The selection happens automatically based on available configuration
The login example normalizes entering usernames and passwords into browser automation without warning about secret handling, reuse of authenticated sessions, or risks from the preserved Chrome profile. In this skill context, that is meaningfully dangerous because browser automation may expose credentials in logs, screenshots, prompts, shell history, or persisted session cookies, enabling account compromise or unintended actions in authenticated contexts.
The download example shows automatic retrieval of a remote file to a local directory but does not emphasize that browsing to a file URL causes a local write. In a browser automation skill, this increases risk of silent storage of untrusted content, accidental retention of sensitive files, and downstream exposure if other tools process the downloaded files automatically.
The reference explicitly states that downloads start automatically and are written to ./agent/downloads without any file type restrictions or an up-front user warning. In a browser automation skill, this can cause silent persistence of untrusted content to disk, including potentially dangerous executables or sensitive files, especially when navigation or actions are driven by natural language and remote web content.
The skill advertises very broad activation criteria for general browsing, extraction, screenshots, form filling, and web-app interaction without any scoping, consent, or sensitivity boundaries. That increases the chance the agent will invoke this skill for routine requests that may involve sensitive sites or data, expanding the attack surface and making misuse more likely.
The file specifies "Google Chrome browser" as required, and later instructs the user to ensure Chrome is installed. This imposes a specific software/environment choice in natural language without offering alternatives or explaining why that locale/environment restriction is necessary.
This is a JSON manifest file, so vague-trigger checks apply. The repeated examples using the generic command phrase "browser navigate" describe how to invoke the skill but do not specify whether activation is limited to this exact command, what variants are supported, or any exclusion conditions, leaving trigger scope ambiguous.
No suspicious patterns detected.