Security audit
Security checks for vulnerabilities and agentic risk
This skill is a web research helper, but it explicitly promotes bypassing paywalls, CAPTCHA, geographic restrictions, and blocked AI access.
Review carefully before installing. Use only for authorized web research and avoid paywalled, CAPTCHA-protected, geoblocked, or otherwise restricted content unless you have explicit rights to access it through BrowserAct. Do not place sensitive business, incident, legal, or credential material in queries unless sending that data to BrowserAct is acceptable.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
}
}
response = requests.post(
MCP_SERVER_URL,
headers={
"Authorization": f"Bearer {BROWSERACT_MCP_TOKEN}",
The narrative normalizes using the skill when direct web access is restricted or blocked, framing restriction evasion as a standard feature rather than an exceptional, authorized workflow. In a web-research skill, this context materially increases risk because the tool is aimed at acquiring information from sites that are actively denying access.
Phrases like 'auto-recovery,' 'global access,' and similar wording soften and normalize what appears to be evasion of access controls. This is dangerous because it obscures the true security and compliance implications, making operators more likely to invoke the skill for restricted targets without informed approval.
The guidance says to use the skill when paywalls prevent data extraction, which semantically directs users toward obtaining gated content without authorization. In context, that is a clear misuse pattern because paywalls are an access control, and encouraging workarounds can facilitate content theft and contractual violations.
The feature list claims built-in mechanisms to avoid human verification challenges and regional IP restrictions, which is explicit anti-protection bypass language. This is dangerous because it advertises operational capability to evade safeguards designed to limit automated or unauthorized access.
The description explicitly promises circumvention of CAPTCHA and regional/IP restrictions without any safety rationale, authorization checks, or user consent flow. That is dangerous because it directly frames the skill as a tool for evading access controls, which can enable unauthorized scraping, policy violations, and abusive collection of gated content.
The skill advertises behavior that requires environment access, network use, and file output, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can cause the host agent to grant broader capabilities than users expect, especially for a skill that performs outbound web access and writes research reports.
The skill describes bypassing geographic restrictions and anti-bot protections but does not warn users about the legal, contractual, and policy implications of doing so. In this context, omission of warnings is risky because the skill is specifically positioned as a fallback when normal access is blocked, making misuse more likely.
The documentation claims the skill avoids CAPTCHA and human verification problems, but the file provides no substantiation, safeguards, or implementation detail for such a sensitive capability. Unverified claims of anti-bot bypass are dangerous because they encourage use against protected services and obscure compliance, legal, and abuse risks.
This script performs external network transmission of user-supplied research queries and derived options to a remote service. In the context of a tool designed to bypass restricted web access, this increases risk because users may assume local processing while the tool actually sends potentially sensitive research topics outside the environment.
}
}
response = requests.post(
MCP_SERVER_URL,
headers={
"Authorization": f"Bearer {BROWSERACT_MCP_TOKEN}",
The skill transmits user-provided queries and search parameters to an external third-party service without an explicit user-facing disclosure or consent step at execution time. If users include sensitive prompts, proprietary topics, credentials, or incident details in queries, that data leaves the local environment and may be retained or processed externally.
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
"""
report = f"# Web Research Report\n\n"
report += f"**Query**: {query}\n\n"
report += f"**Date**: {__import__('datetime').datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n\n"
report += "## Executive Summary\n\n"
report += f"{extracted['summary']}\n\n"
The manifest describes a web research assistant that searches the internet via BrowserAct, but it does not mention reading credentials from the environment. While authenticating to BrowserAct may be operationally necessary, accessing environment-stored secrets is still an additional capability beyond the stated user-facing purpose.
No suspicious patterns detected.