Security audit

browser4-cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly documented browser automation, but it also grants broad access to live browser sessions, saved login state, background execution, and skill-management actions that users should review carefully.

Install only if you intend to give the agent broad browser-control authority. Use dedicated test browser profiles and test accounts, avoid attaching to personal or production sessions, do not import full browser profiles unless necessary, treat HAR/state/profile files and extension tokens as secrets, and review any skill-management, loop --shell, crawl/swarm, or LLM-backed agent actions before running them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The skill is presented as browser automation for testing and extraction, but it also exposes backend skill-management capabilities that can modify or install agent instructions. That creates scope creep beyond the declared purpose and can let an agent alter its execution environment or available skills without clear user intent or guardrails.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: Documenting profile import of passwords, cookies, history, bookmarks, and extensions from system browsers gives this skill access to highly sensitive local data that is unrelated to ordinary browser testing. In an agent setting, this materially increases the risk of credential theft, session hijacking, and privacy compromise if the feature is invoked or socially engineered.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Importing data from system browsers is an unjustified privileged capability for a skill advertised for testing, screenshots, form filling, and extraction. The mismatch between stated purpose and actual capability makes accidental misuse or covert credential/session harvesting much more dangerous in the agent context.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The skill covers form filling, cookie and storage manipulation, browser-state import, and network/HAR capture, all of which can expose credentials, tokens, PII, and session data. Without clear privacy and consent warnings, an agent may collect or persist sensitive material in ways the user does not anticipate.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation encourages users to submit natural-language tasks for autonomous browser execution and notes that the CLI sends HTTP requests to a backend, but it does not clearly warn that task content, page data, and potentially sensitive browser context may be transmitted to the backend and then to an external LLM provider. This can lead users to unknowingly expose credentials, personal data, internal URLs, or session-derived content during autonomous browsing and extraction workflows.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation explicitly promotes attaching to an already-running browser and reusing authenticated state, but does not warn that the tool may gain visibility and control over live tabs, cookies, session state, and other sensitive in-browser data. In a browser-automation skill, that omission is security-relevant because users may connect to personal or production-authenticated sessions without understanding the privacy and account-impact risks.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The extension token instructions describe persisting an auto-approval token in an environment variable to bypass manual approval, but do not clearly warn that any future CLI process in that environment may connect without user confirmation. If the token is exposed through shell history, process environment inspection, shared accounts, or reused terminals, an attacker or unintended workflow could silently attach to the browser session.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The reference encourages crawling arbitrary URLs, recursive link following, seed-file bulk fetching, and writing extracted results to local files, but it does not provide guardrails about sensitive data collection, authorization boundaries, robots/ToS compliance, or resource-impact limits. In an agent skill context, this can enable privacy-invasive scraping, accidental collection of secrets or personal data, and filesystem persistence of harvested content without clear operator awareness.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documented workflow walks an agent from form discovery to `fill` and `select` actions on live sites, but it does not explicitly warn about submitting real user data, triggering side effects, or obtaining authorization before interacting with production forms. In an automation skill, that omission can normalize unsafe use on insurance, tax, or loan forms and lead operators to test against live systems with sensitive data or accidental submissions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation recommends exporting full HTML compliance snapshots and storing them in a versioned S3 bucket, but it does not warn that captured pages may contain sensitive data such as session-specific content, customer information, tokens, or regulated disclosures. In an automation/browser-testing skill, this is more dangerous because the tool is explicitly designed to capture rendered page contents at scale, making accidental long-term retention and wider exposure of sensitive HTML more likely.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The baseline promotion example uses a destructive `rm -rf ./snapshots/baseline` before copying the current snapshots, without any caution about irreversible deletion or validation of the replacement set. In CI/E2E workflows, this can cause loss of historical baselines, accidental promotion of bad snapshots, and reduced ability to detect regressions if operators run the command blindly.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The guide promotes persistence and raw HTML storage without warning that fetched pages may contain personal data, session artifacts, regulated content, or other sensitive information. In a browser automation skill, normal use can easily capture login pages, account data, or internal application content, so silent storage increases privacy, retention, and compliance risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The authentication token example encourages passing secrets directly on the command line, which can expose them via shell history, process listings, CI logs, screenshots, and shared documentation. In a browser-testing/automation context this is especially risky because commands are often scripted, copied, debugged, and logged extensively, making credential leakage likely.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation explicitly promotes capturing full network traffic, including headers and response bodies, and sharing HAR files, but it does not warn that these artifacts often contain session cookies, bearer tokens, CSRF tokens, API keys, PII, and form contents. In a browser automation skill, this omission is dangerous because operators may collect and export sensitive production traffic and expose it through logs, stdout, or shared files.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The request-detail command returns full request/response headers and bodies on demand, but the docs do not caution that printing this data can leak secrets directly to terminal output, logs, transcripts, or downstream tools. The feature is legitimate for debugging, but the missing warning increases the chance of accidental disclosure during routine troubleshooting.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill documents saving HAR files to disk and printing HAR JSON to stdout without warning that these outputs may persist sensitive network contents long after the session ends. Because HAR files are easy to share and inspect, they create a durable exfiltration and accidental-disclosure risk if stored insecurely or attached to bug reports.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation states that agent tasks use memory features and that completed or failed tasks are automatically persisted to a knowledge store, but it does not clearly warn users that prompts, extracted page data, credentials, or other sensitive browsing artifacts may be retained beyond the current run. In a browser automation skill, users may operate on private sites, forms, account data, or internal applications, so silent persistence creates a meaningful privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation encourages exporting cached browser pages to local files but does not warn that the cache may contain sensitive or regulated data such as authenticated pages, tokens in page content, personal data, or internal application content. In a browser automation/testing tool, this omission can lead users to persist sensitive material to disk unintentionally, increasing exposure through local compromise, backups, shared workspaces, or CI artifacts.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The documentation explicitly describes loading arbitrary external URLs and even supports load options, but it omits any warning about outbound network access, privacy exposure, or SSRF-style risk. In a browser automation and web interaction skill, this can normalize fetching attacker-controlled or internal URLs without informing users or implementers about the security boundaries.

Credential Access

High

Category: Privilege Escalation
Content: | `network requests`, `network request <id>`, `network har start`, `network har stop`, `network route`, `network unroute` | Network request inspection, HAR recording & request routing | Inspect what the page loaded (XHR/fetch/status/headers), debug API calls, record a `.har` file (Chrome DevTools importable), or mock/abort matching requests (Fetch interception). `network requests --filter api --status 2xx`; `network har start --content text` then `network har stop ./capture.har`; `network route "**/api/users" --body '{"users":[]}'` | [network.md](references/network.md) | | `profiler start`, `profiler stop` | V8 CPU profiling via CDP | Profile page interactions and save `.cpuprofile` (Chrome DevTools / speedscope compatible) | — | | `profiles list` | List browser profile directories | See what profiles exist under `~/.browser4/browser/chrome` before `open --profile` | — | | `profile-import` | Import bookmarks/history/passwords/cookies/extensions from system Chrome/Edge/Safari (requires the browser4-profile-import plugin) | `profile-import --list-sources` to discover browsers; `profile-import --source chrome --data bookmarks,cookies` copies a whole profile snapshot to `~/.browser4/imports/`; `--into prototype|default` seeds a managed profile dir; then `open --profile <dir>` mounts it | [browser-state-import.md](references/browser-state-import.md) | | `config` | Persistent CLI defaults (server, timeout, proxy, session) | Set default server URL, timeout, proxy, or session name | [config.md](references/config.md) | | `status`, `doctor`, `doctor log`, `doctor metrics`, `doctor status` | Server health & diagnostics | `doctor status` prints the aggregated status report (health, build, runtime, LLM, sessions, browsers, swarm, plugins, skills, metrics, logs) in layers: summary by default, `--verbose` for full detail, `--section <name>` for one report, `--json` for machine-readable output. `status` prints the web status panel URL (`http://<server>:8182/status`) — a live dashbo ...[truncated 24 chars]
Confidence: 99% confidence
Finding: The profile-import capability explicitly includes passwords and cookies from installed browsers, which squarely enables credential access and reuse of authenticated sessions. In an agent-executable skill, this is highly dangerous because it can be abused to extract secrets or impersonate the user across websites and services.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Content: | `network requests`, `network request <id>`, `network har start`, `network har stop`, `network route`, `network unroute` | Network request inspection, HAR recording & request routing | Inspect what the page loaded (XHR/fetch/status/headers), debug API calls, record a `.har` file (Chrome DevTools importable), or mock/abort matching requests (Fetch interception). `network requests --filter api --status 2xx`; `network har start --content text` then `network har stop ./capture.har`; `network route "**/api/users" --body '{"users":[]}'` | [network.md](references/network.md) | | `profiler start`, `profiler stop` | V8 CPU profiling via CDP | Profile page interactions and save `.cpuprofile` (Chrome DevTools / speedscope compatible) | — | | `profiles list` | List browser profile directories | See what profiles exist under `~/.browser4/browser/chrome` before `open --profile` | — | | `profile-import` | Import bookmarks/history/passwords/cookies/extensions from system Chrome/Edge/Safari (requires the browser4-profile-import plugin) | `profile-import --list-sources` to discover browsers; `profile-import --source chrome --data bookmarks,cookies` copies a whole profile snapshot to `~/.browser4/imports/`; `--into prototype|default` seeds a managed profile dir; then `open --profile <dir>` mounts it | [browser-state-import.md](references/browser-state-import.md) | | `config` | Persistent CLI defaults (server, timeout, proxy, session) | Set default server URL, timeout, proxy, or session name | [config.md](references/config.md) | | `status`, `doctor`, `doctor log`, `doctor metrics`, `doctor status` | Server health & diagnostics | `doctor status` prints the aggregated status report (health, build, runtime, LLM, sessions, browsers, swarm, plugins, skills, metrics, logs) in layers: summary by default, `--verbose` for full detail, `--section <name>` for one report, `--json` for machine-readable output. `status` prints the web status panel URL (`http://<server>:8182/status`) — a live dashbo ...[truncated 24 chars]
Confidence: 95% confidence
Finding: The information-stealer match is substantively supported because the skill advertises importing browser cookies, passwords, history, and extensions from local browsers. Even if intended for migration or debugging, these are the same data classes abused by infostealers, and including them in a general automation skill makes the context significantly more dangerous.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Content: --- title: "Import Browser State" description: "Reuse logged-in state (cookies, localStorage) or an entire profile from your system Chrome/Edge inside Browser4-managed sessions. Covers attach + state-save/state-load, the deprecated SYSTEM_DEFAULT mode, and full-profile copy via PROTOTYPE or open --profile." tier: procedure ---
Confidence: 96% confidence
Finding: This documentation explicitly describes importing cookies, localStorage, and even full browser profiles from a user's system browser into another session. Those artifacts commonly contain live authentication tokens and other sensitive session material, so the capability can be used to bypass authentication and impersonate the user if misused or exposed. In the context of a browser-automation skill, this is more dangerous than generic browser docs because it operationalizes session extraction and reuse as a normal workflow.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/agent.md:25