unbrowser

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:33 AM UTC
• Version: 0.0.21

Overview

The skill is a disclosed web-discovery helper with sensitive cookie and native-binary risks that are mostly scoped and explained.

Install only if you trust the pyunbrowser upstream package and are comfortable with a local browsing binary making requests from your machine. Treat any cookies given to it as login credentials, keep them host-scoped, approve account-changing actions explicitly, and prefer pinned or reviewed package versions in sensitive environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:97
• Finding: Unpinned Third-Party Native Binary Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 97–106 **Vulnerability Type**: Unpinned and mutable third-party native dependencies **Risk Level**: Medium ### Vulnerable Code ```bash pip install pyunbrowser # Optional: installs the Chrome/CDP helper for local challenge-cookie handoff. pip install 'pyunbrowser[solver]' # Or with pipx for an isolated CLI: pipx install pyunbrowser # Or with uv: uv tool install pyunbrowser ``` ```text The wheel ships the platform-specific native binary inside it and registers an `unbrowser` script on `$PATH`. macOS (arm64/x86_64) and Linux (x86_64/aarch64) are supported; other platforms must build from source (`cargo install --git https://github.com/protostatis/unbrowser`). PyPI distribution name is `pyunbrowser`, not `unbrowser`, due to PyPI name moderation; the binary and import name are still `unbrowser`. ``` The related installation guidance at lines 56–57 explicitly recommends installing or upgrading to the latest release: ```text - Prefer isolated installation. `pipx install pyunbrowser` or `uv tool install pyunbrowser` quarantine the binary and its native dependency. `pip install --user` is acceptable but mixes the binary into the user's site-packages. - Install the latest version. `pipx install pyunbrowser` (or `pipx upgrade pyunbrowser` if you already have it) pulls the current release. The wheel ships a platform-specific native binary; verify the upstream repository (https://github.com/protostatis/unbrowser) before upgrading across versions. ``` ### Technical Analysis The Skill directs users or Agents to download and execute `pyunbrowser` without a pinned package version, artifact checksum, cryptographic signature, or dependency lockfile. The package includes a platform-specific native executable, so installation introduces code that is not contained in or reviewable from this Skill package. The alternative Cargo command also installs directly from a mutable Git repository reference without ...[truncated 2199 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `pyunbrowser` and optional solver dependencies to exact, reviewed versions rather than installing the latest release: ```bash pipx install 'pyunbrowser==REVIEWED_VERSION' ``` 2. For source installation, pin a reviewed immutable Git commit: ```bash cargo install --git https://github.com/protostatis/unbrowser --rev REVIEWED_COMMIT ``` 3. Publish expected SHA-256 hashes or verified signatures for every supported platform-specific binary and require verification before execution. 4. Maintain a lockfile or equivalent manifest for all transitive dependencies used to build and distribute the binary. 5. Remove automatic “install latest” and unconditional upgrade recommendations. Require security review before changing the pinned version or commit. 6. Prefer reproducible builds from audited source and document how users can compare locally built artifacts with published releases. 7. Continue recommending isolated installation, but clarify that environment isolation does not replace artifact integrity verification. 8. Minimize the runtime exposure of the native binary by running it under a dedicated low-privilege account or sandbox and granting access only to the target network destinations and runtime cookies required for the active task. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

- **Multipart uploads.** `submit` supports GET and `application/x-www-form-urlencoded` POST only; multipart upload forms require escalation.
- **Heavy JIT-bound JS** (Google Sheets, Figma, Notion editor). QuickJS is 20–50× slower than V8 — the page may technically run but settle times will be unworkable.
- **Login flows that require interactive auth.** Use the managed browser to log in once. Cookies exported from that session can be replayed via `cookies_set` **for the same site only** — see [Operational safety](#operational-safety) for the rules around cookie reuse.

## Escalation accountability

The default workflow is **unbrowser first**, not **unbrowser only**. If the user explicitly says `unbrowser only`, do not use the managed browser/CDP; return the `unbrowser` failure signal and ask before escalating.

- Escalate only after a concrete signal, such as: non-null `challenge`, `likely_js_filled` with no usable JSON store, a visual/browser-only requirement, interactive auth,

• Confidence: 82% confidence
• Finding: The skill explicitly supports importing and replaying browser-exported cookies via `cookies_set`, which enables authenticated session reuse without password or 2FA. Even though the document adds same-site and confirmation guardrails, this capability materially increases the risk of credential misuse, session hijacking, and unauthorized account access if an agent is compromised, mis-prompted, or given improperly sourced cookies.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Prefer `query_text` / `query` when the page has stable visible labels or selector hints.
- Prefer `text_main` when the task is reading article/docs content.
- Prefer `extract`, `extract_cards`, `extract_list`, or `extract_table` when the page exposes structured data.
- Prefer `activate` for safe, reversible probes such as menus, tabs, and load-more controls; do not use it for authenticated state-changing actions without confirmation.
- If `chrome_escalation` is near the top, stop guessing and escalate instead of burning calls.

## RPC methods — advanced (use sparingly)

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Scope Creep

Low

• Category: Excessive Agency

Content

| `blockmap.density.likely_js_filled === true` AND `json_scripts === 0` | Empty SSR shell, JS-rendered cells | Escalate. |
| `blockmap.structure` is empty or only `<body>` and the task needs structured content | DOM didn't settle, or the page is canvas/WebGL-only | Escalate. |
| `discover.escalations` contains route-level browser-only hints | The cheap path found a specific blocked URL/action | Escalate with that target instead of a vague page-level instruction. |
| `discover.routes` is empty with `same_origin: true` | No page-owned routes were found | Return that finding or broaden scope; don't invent routes. |
| `status >= 400` and no challenge detected | Genuine error | Don't escalate — the page is broken / rate-limited. Return the error. |

The `challenge` and `density` fields in `navigate`'s response are designed for exactly this routing decision — read them on every call.

• Confidence: 75% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.