Stagehand Browser CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:13 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is purpose-aligned, but it gives an agent broad website interaction power with under-scoped remote browsing, persistent sessions, internal network reach, and automatic downloads.

Install only if you are comfortable giving the agent broad browser control. Avoid using it for banking, admin consoles, private accounts, or internal services unless you explicitly manage isolated browser profiles, clear cookies/passwords, and review downloads. Be aware that Browserbase mode may be used automatically when configured keys exist, and the submitted artifact does not include the referenced implementation files for review.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: REFERENCE.md:288

Finding

Persistent Browser Profile Exposes Authentication State Across Tasks

Content

View full analysis

Vulnerability Details

File Location: REFERENCE.md:288-296, REFERENCE.md:454-459, EXAMPLES.md:110-111
Vulnerability Type: Persistent storage of browser credentials and session cookies
Risk Level: High

Vulnerable Code and Documentation

REFERENCE.md:288-296:

bash

--remote-debugging-port=9222
--user-data-dir=.chrome-profile
--window-position=-9999,-9999
--window-size=1280,720

REFERENCE.md:454-459:

text

### Credential Handling

- Browser uses persistent profile (`.chrome-profile/`)
- Saved passwords and cookies persist between sessions
- Consider using isolated profiles for sensitive operations

EXAMPLES.md:110-111:

text

**Note**: This example uses Chrome's user profile (`.chrome-profile/`) which may preserve session cookies between runs.

Technical Analysis

Chrome is configured with a fixed .chrome-profile directory. The documentation explicitly states that saved passwords and cookies persist between sessions, while the documented close operation preserves the profile.

This violates session isolation: unrelated users, tasks, or agent invocations can inherit authentication cookies, browsing history, local storage, and other browser state from previous executions. Merely closing the browser does not revoke the retained authenticated sessions.

The supplied artifact does not include the referenced src/cli.ts, so implementation-level safeguards cannot be verified. The documented configuration itself nevertheless establishes persistent cross-task browser state.

Attack Path

1. A user signs in to a website through the browser skill.
2. The website stores an authenticated session cookie or token in .chrome-profile.
3. The browser is closed, but the profile directory remains on disk.
4. A later task starts Chrome with the same fixed profile directory.
5. The later task navigates to the previously authenticated website and inherits the ex ...[truncated 748 chars]

Remediation

View remediation

Remediation Suggestions

• Create a unique temporary Chrome profile for every task or security principal.
• Delete temporary profiles during cleanup, including after abnormal termination.
• Disable browser password storage and automatic sign-in.
• Make profile persistence an explicit, informed opt-in rather than the default.
• Never share persistent profiles between users or independent agent sessions.
• Store any intentionally persistent profile with restrictive filesystem permissions.
• Provide a command that securely clears cookies, local storage, service workers, caches, and saved credentials.
• Require user confirmation before reusing an authenticated session for sensitive or state-changing actions.
• Document session lifetime and isolation guarantees clearly.

T09 · Insecure Skill Coding Practices

Warning

• Location: REFERENCE.md:302

Finding

Unrestricted Network Reach and Automatic Downloads Enable Internal Resource Access and Unsafe File Storage

Content

View full analysis

Vulnerability Details

File Location: REFERENCE.md:302-311, REFERENCE.md:461-470, EXAMPLES.md:145-160
Vulnerability Type: Unrestricted browser network access and uncontrolled automatic downloads
Risk Level: Medium

Vulnerable Code and Documentation

REFERENCE.md:302-311:

typescript

await client.send("Browser.setDownloadBehavior", {
  behavior: "allow",
  downloadPath: "./agent/downloads",
  eventsEnabled: true,
})

text

**Behavior**:
- Downloads start automatically (no dialog)
- Files saved to `./agent/downloads/`
- Download events can be monitored via CDP

REFERENCE.md:461-470:

text

### Download Safety

- Downloads automatically saved to `./agent/downloads/`
- No file type restrictions enforced
- Verify downloaded file integrity before use

### Network Access

- Browser has full network access
- Respects system proxy settings
- Can access localhost and internal networks

EXAMPLES.md:145-160:

bash

browser navigate https://example.com/documents/report.pdf

bash

browser act "Wait for 5 seconds for the download to complete"

text

**Note**: Files are automatically downloaded to `./agent/downloads/` directory due to CDP configuration.

Technical Analysis

The documented browser can access localhost and internal networks without a destination policy. If an attacker can influence a navigation target, page redirect, or AI-generated browser action, the browser can be used to reach services that are unavailable from the public Internet.

Download behavior is globally set to allow. Files are saved without a confirmation dialog, and the documentation states that no file-type restriction is enforced. The available artifact does not demonstrate URL validation, redirect revalidation, private-address blocking, MIME validation, file-size limits, filename sanitization, or download quarantine.

The browser's ability ...[truncated 1459 chars]

Remediation

View remediation

Remediation Suggestions

• Allow only https destinations by default and reject unsupported schemes.
• Resolve hostnames before navigation and block loopback, private, link-local, multicast, and cloud-metadata address ranges.
• Revalidate every redirect and DNS resolution to mitigate redirect-based bypasses and DNS rebinding.
• Introduce explicit hostname allowlists or task-scoped destination policies.
• Require user confirmation before accessing local or internal network destinations.
• Disable automatic downloads by default and require explicit approval for each download.
• Enforce MIME-type, extension, and maximum-size policies.
• Generate safe server-independent filenames and prevent path traversal or filename collisions.
• Store downloads in a task-specific quarantine directory with restrictive permissions.
• Scan downloaded content before exposing it to other tools, and never execute or automatically open it.
• Apply disk quotas and remove quarantined downloads at the end of the task unless the user explicitly retains them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

### First: Environment Selection (Local vs Remote)

The skill automatically selects between local and remote browser environments:
- **If Browserbase API keys exist** (BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in .env file): Uses remote Browserbase environment
- **If no Browserbase API keys**: Falls back to local Chrome browser
- **No user prompting**: The selection happens automatically based on available configuration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.json (reported line 17)May include surrounding context.

json

### First: Environment Selection (Local vs Remote)

The skill automatically selects between local and remote browser environments:
- **If Browserbase API keys exist** (BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in .env file): Uses remote Browserbase environment
- **If no Browserbase API keys**: Falls back to local Chrome browser
- **No user prompting**: The selection happens automatically based on available configuration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.json (reported line 29)May include surrounding context.

json

### First: Environment Selection (Local vs Remote)

The skill automatically selects between local and remote browser environments:
- **If Browserbase API keys exist** (BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in .env file): Uses remote Browserbase environment
- **If no Browserbase API keys**: Falls back to local Chrome browser
- **No user prompting**: The selection happens automatically based on available configuration

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example explicitly demonstrates entering plaintext credentials and notes that Chrome's user profile may preserve session cookies between runs, but it does not clearly warn about credential handling, session reuse, or privacy risks. In an automation skill, this can normalize unsafe operator behavior and lead to accidental credential exposure, unintended account access persistence, or cross-task session leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The reference explicitly states that downloads start automatically and are written to a persistent local directory, but it does not frame this as a high-risk behavior requiring user awareness or confirmation. In a browser automation skill with full network access and access to arbitrary sites, this can lead to silent persistence of untrusted files, disk pollution, and downstream execution or processing risks if other tools consume downloaded content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use the skill when the user asks to "browse websites, navigate web pages, extract data from websites, take screenshots, fill forms, click buttons, or interact with web applications." Several of these triggers are broad everyday requests and there are no exclusion conditions or negative examples to clarify when this skill should or should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill silently switches to a remote Browserbase environment whenever API keys are present, without informing the user that page contents, inputs, session data, and browsing activity may be transmitted to a third-party service. In a browser automation context, this is especially risky because the skill may handle authenticated sessions, form entries, and sensitive web content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The download example states that files are automatically written to a local directory, but it does not warn that this changes local state or discuss risks from downloading untrusted content. In a browser automation context, silent downloads can introduce unsafe files, consume disk space, or surprise users who did not expect filesystem side effects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.