Functions

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:13 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent Browserbase Functions guide, but it gives unsafe credential-handling and unpinned package-execution instructions that users should review before installing.

Install only if you are comfortable reviewing the commands first. Pin the Browserbase SDK package version, avoid printing .env, keep .env out of version control, use the least-privileged Browserbase key available, and rotate the key if it has appeared in logs or shared transcripts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37

Finding

Unpinned Third-Party Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37 and 274
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Vulnerable Code

bash

pnpm dlx @browserbasehq/sdk-functions init my-function

bash

# Or use npx
npx @browserbasehq/sdk-functions dev index.ts

Technical Analysis

The skill instructs users to download and immediately execute @browserbasehq/sdk-functions without specifying an exact, reviewed version or an integrity constraint. Both pnpm dlx and npx can resolve the package from a remote registry at execution time. Consequently, the code executed by these commands may differ from the code available when the skill was audited.

This creates a supply-chain trust boundary in which a compromised publisher account, malicious future package release, registry compromise, or unexpected dependency change could cause arbitrary package code or lifecycle scripts to execute locally. The risk is especially relevant because the prerequisite instructions export BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID into the environment, while the development command may be run in a project containing a credential-bearing .env file.

The commands are related to the skill's declared deployment functionality, but dynamically executing an unspecified package version is broader than necessary. An exact reviewed version and lockfile would provide the required functionality with less supply-chain exposure.

Attack Path

1. An attacker compromises the package publisher, registry entry, or a transitive dependency, or publishes a malicious future release.
2. The user follows the skill and runs the unpinned pnpm dlx or npx command.
3. The package manager resolves and downloads the attacker-controlled release.
4. The malicious package executes with the permissions of the current local user.
5. It reads accessible environment variables, project files, or .env credenti ...[truncated 766 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @browserbasehq/sdk-functions to an exact, reviewed version in every command, rather than using an implicitly resolved latest version.
• Install the dependency into the project and commit a lockfile with integrity metadata before running the CLI.
• Replace ad hoc pnpm dlx and npx fallback execution with a package script that invokes the locked local dependency.
• Review package provenance, publisher identity, release signatures or attestations, and transitive dependency changes before upgrades.
• Run initialization before exporting credentials whenever credentials are not needed for that step.
• Execute dependency installation and initialization in a restricted environment without unrelated secrets or sensitive files.
• Document an explicit upgrade and review process rather than allowing automatic resolution to future versions.

Example hardened workflow:

bash

pnpm add --save-exact @browserbasehq/sdk-functions@REVIEWED_VERSION
pnpm exec bb init my-function

The exact command should be verified against the reviewed version's official CLI interface, and the resulting lockfile should be retained.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:258

Finding

Troubleshooting Command Exposes the Complete Environment File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 258-262
Vulnerability Type: Plaintext sensitive-information disclosure
Risk Level: Medium

Vulnerable Code

bash

### "Missing API key"
```bash
# Check .env file has credentials
cat .env

text

### Technical Analysis

The skill explicitly instructs users to store `BROWSERBASE_API_KEY` and `BROWSERBASE_PROJECT_ID` in `.env`, then recommends `cat .env` when troubleshooting a missing API key. This prints the complete file rather than checking whether the expected variable exists.

Terminal output may be retained in CI logs, agent tool transcripts, remote support sessions, shell-recording systems, screen-sharing captures, or copied diagnostic reports. The file may also contain unrelated credentials added by the user. Printing every value therefore violates least disclosure and creates avoidable secret exposure.

The command does not itself transmit data over the network, and no covert exfiltration endpoint was identified. Exploitation depends on an attacker or untrusted service being able to observe or collect the resulting output.

### Attack Path

1. A user encounters the documented “Missing API key” condition.
2. The user runs `cat .env` as instructed.
3. The terminal displays the Browserbase API key and every other value stored in the file.
4. The output is captured by an agent transcript, CI log, support recording, shared terminal, screen share, or another observer.
5. An attacker retrieves the exposed API key.
6. The attacker submits authenticated requests to Browserbase within the key's assigned permissions, such as invoking functions or consuming account resources.

### Impact Assessment

Disclosure may grant an attacker the Browserbase permissions associated with the exposed API key. Depending on the key's server-side authorization, this could include invoking deployed functions, accessing invocation results, consuming paid resources
...[truncated 281 chars]

Remediation

View remediation

Remediation Suggestions

• Remove cat .env from the troubleshooting guidance.
• Check only whether the required key is present, without displaying its value.
• Redact secret values in all diagnostic output, examples, logs, and support transcripts.
• Recommend restrictive permissions such as chmod 600 .env.
• Ensure .env is excluded from version control and deployment artifacts where it is not required.
• Advise users to rotate the API key immediately if it has been printed into a shared or retained log.
• Avoid storing unrelated credentials in the same environment file.

A safer presence check is:

bash

if grep -q '^BROWSERBASE_API_KEY=.' .env; then
  echo "BROWSERBASE_API_KEY is configured"
else
  echo "BROWSERBASE_API_KEY is missing or empty"
fi

This confirms configuration without printing the credential itself.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (14)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The project structure explicitly instructs users to place credentials in a .env file, normalizing local secret storage without any accompanying safeguard language. In isolation this is common practice, but in a reusable skill it materially increases the risk of secret leakage if users do not understand that .env must be protected.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

my-function/ ├── package.json ├── index.ts # Your function code └── .env # Add credentials here

text

### 2. Add Credentials to .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The section heading directly tells users to add credentials to .env, creating a high likelihood that real secrets will be written to disk without any warning or compensating controls. In agent-assisted workflows, users may follow this verbatim and then accidentally expose the file through repository commits or diagnostics.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

└── .env # Add credentials here

text

### 2. Add Credentials to .env

```bash
# Copy from stored credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Appending BROWSERBASE_API_KEY directly into .env from the shell encourages persistence of a sensitive credential on disk and may also expose it through shell history or surrounding automation logs. If the .env file is later committed or uploaded, an attacker could invoke Browserbase resources using the stolen API key.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

bash

# Copy from stored credentials
echo "BROWSERBASE_API_KEY=$BROWSERBASE_API_KEY" >> .env
echo "BROWSERBASE_PROJECT_ID=$BROWSERBASE_PROJECT_ID" >> .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The same issue applies to the project ID when written alongside the API key in .env: while the project ID may be less sensitive alone, bundling it with the API key facilitates immediate unauthorized use if the file leaks. The documentation does not tell users how to prevent that leak.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

bash

# Copy from stored credentials
echo "BROWSERBASE_API_KEY=$BROWSERBASE_API_KEY" >> .env
echo "BROWSERBASE_PROJECT_ID=$BROWSERBASE_PROJECT_ID" >> .env

Or manually edit .env:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The troubleshooting section advises inspecting .env to verify credentials, but does not warn that displaying secret files in terminals can leak them via screen sharing, shell logs, CI logs, or captured transcripts. This is risky in an agent setting where command output may be retained.

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

"Missing API key"

bash

# Check .env file has credentials
cat .env

# Or set for current shell

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The troubleshooting guidance continues to normalize direct handling of secret-bearing .env content without any masking or exposure warning. In contexts where outputs are captured, this can inadvertently disclose valid credentials to unauthorized viewers.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

"Missing API key"

bash

# Check .env file has credentials
cat .env

# Or set for current shell
export BROWSERBASE_API_KEY="your_key"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs users to obtain and set API credentials but does not warn that these secrets are sensitive or should be stored securely. In an agent/automation context, this omission increases the chance that users expose credentials in shell history, logs, screenshots, or committed files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions append live API credentials into a .env file without warning users to avoid committing or exposing that file. This is dangerous because .env files are commonly leaked through source control, backups, artifact uploads, or debugging output, which would grant unauthorized access to the Browserbase account.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

2. Test Locally

bash

curl -X POST http://127.0.0.1:14113/v1/functions/my-function/invoke \
  -H "Content-Type: application/json" \
  -d '{"params": {"url": "https://news.ycombinator.com"}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

bash

# Start invocation
curl -X POST "https://api.browserbase.com/v1/functions/FUNCTION_ID/invoke" \
  -H "Content-Type: application/json" \
  -H "x-bb-api-key: $BROWSERBASE_API_KEY" \
  -d '{"params": {"url": "https://example.com"}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

bash

# Start invocation
curl -X POST "https://api.browserbase.com/v1/functions/FUNCTION_ID/invoke" \
  -H "Content-Type: application/json" \
  -H "x-bb-api-key: $BROWSERBASE_API_KEY" \
  -d '{"params": {"url": "https://example.com"}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

bash

# Start invocation
curl -X POST "https://api.browserbase.com/v1/functions/FUNCTION_ID/invoke" \
  -H "Content-Type: application/json" \
  -H "x-bb-api-key: $BROWSERBASE_API_KEY" \
  -d '{"params": {"url": "https://example.com"}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

bash

# Start invocation
curl -X POST "https://api.browserbase.com/v1/functions/FUNCTION_ID/invoke" \
  -H "Content-Type: application/json" \
  -H "x-bb-api-key: $BROWSERBASE_API_KEY" \
  -d '{"params": {"url": "https://example.com"}}'

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.