qqbrowser-use

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:50 AM UTC
• Version: 1.0.16

Overview

The skill is a coherent browser automation tool, but it needs review because its replay guidance allows unescaped variables inside executable page JavaScript and its installation path trusts mutable external downloads.

Install only if you trust the package publisher and browser installer, preferably with a pinned reviewed version and verified download source. Do not replay playbooks from untrusted sources, and avoid putting untrusted or unsanitized values into playbook variables used inside JavaScript; inspect side-effecting playbooks before they submit, publish, purchase, delete, or message anything.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Package and Browser Installation Creates Supply-Chain Execution Risk

Content

View full analysis

Remediation

View remediation

" ``` 2. Publish and verify SHA-256 hashes for the Python package and all downloaded browser artifacts. 3. Use package-manager hash enforcement where possible, such as a locked requirements file with `--require-hashes`. 4. Document the exact official browser download origin, expected artifact name, version, checksum, and signature-verification procedure. 5. Require TLS certificate validation and fail closed when artifact integrity or signature validation fails. 6. Recommend installation in an isolated environment under a non-privileged account. 7. Maintain a dependency lock file and periodically audit direct and transitive dependencies. 8. Avoid automatically upgrading to unreviewed versions; require an explicit review and version update. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/playbook.md:525

Finding

Unsafe Replay-Parameter Interpolation into Executable JavaScript

Content

View full analysis

({ name: el.querySelector('.name')?.textContent?.trim(), price: el.querySelector('.price')?.textContent?.trim() })))" }, "description": "Extract product list" } ``` ``` ### Technical Analysis The guide explicitly permits `{{param}}` placeholders for selectors, keywords, counts, and arbitrary user data inside a `browser_eval_content_js` script. The example places `{{count}}` directly inside a quoted JavaScript literal: ```javascript Number('{{count}}') ``` No escaping, contextual encoding, type enforcement, or structured argument-passing mechanism is specified. If the replay engine resolves placeholders using textual substitution, a value containing quote characters and JavaScript syntax can terminate the intended string literal and modify the executable script. This is a code-injection boundary because replay variables can originate from user input or from output routed between subtasks in a composite workflow. Treating these values as JavaScript source rather than data allows an untrusted parameter to affect program structure. The resulting JavaScript executes in the context of the current page. Depending on the page origin and Content Security Policy, injected code could r ...[truncated 1929 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest description includes Chinese trigger phrases as part of the activation guidance, but the skill does not state that it is intended only for Chinese-speaking users or provide an opt-in language/locale choice. This can violate a language/locale policy when deployed in broader environments because it implicitly assumes Chinese-language interaction patterns.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 371)May include surrounding context.

md

### Detecting Login, CAPTCHA & Anti-Bot Interception

**Trigger only on suspicion — do NOT run this check on every step.** Pages that load normally need no verification; adding a check to each step only slows the task. Start this check only when you observe at least one of:

- Expected content never renders: a list / search / task page stays on a placeholder (e.g. `加载中…` / `Loading…`) across 2+ samples after `browser_wait`, with no expected elements present.
- The page shell (header / nav / footer) is present but the main content area is empty.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instructions recommend interactive options such as "已手动登录，请继续" / "暂不登录" for user prompts, but do not provide a language choice or justify that the skill is restricted to a Chinese locale. In a general-purpose skill, this effectively forces a specific language for user interaction.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The guide instructs saving generated playbooks under a persistent directory in the user's home folder. Because playbooks can contain recorded workflow structure, URLs, selectors, and parameterized references to user data or file paths, persistent storage creates a risk of unintended retention of sensitive automation artifacts and reuse beyond the original task context.

Content

Scanner excerpt · references/playbook.md (reported line 178)May include surrounding context.

md

#    2g: Add metadata, params, settings, and descriptions

# 3. Save
mkdir -p ~/.qqbrowser-skill/playbooks
# Write JSON to ~/.qqbrowser-skill/playbooks/<kebab-case-name>.json

# 4. Verify safely

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/session-lifecycle.md (reported line 14)May include surrounding context.

md

## Hard Rules

- **Always start with `browser_start_session`** (or `browser_attach_session` when the task must operate on already-open tabs — see [Attaching Existing Tabs](#attaching-existing-tabs-browser_attach_session)), before any other `browser_*` command. Calling other commands without an active session is **forbidden** — it will mix AI-driven tabs with the user's personal browsing.
- **Isolation mode is fixed to `enforce`** and is no longer configurable from the client side — `browser_start_session` does not accept an `--isolation` flag. Every AI task automatically runs in the enforced Tab Group isolation mode.
- **Always call `browser_end_session`** when the task finishes (success, failure, or early exit), so the in-memory mapping is released cleanly.
- **One `sessionId` per task.** Generate a unique, stable ID per task and do **not** reuse it across unrelated tasks. Recommended format: `task-<purpose>-<counter>` (e.g. `task-form-001`, `task-extract-002`). UUIDs or other stable unique strings also work.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/session-lifecycle.md (reported line 44)May include surrounding context.

Attaching Existing Tabs (browser_attach_session)

For tasks that need to interact with tabs that are already open (not create new ones), use browser_attach_session. It complements browser_start_session, which always creates a new tab.

bash

browser_attach_session --tabIds "[<tabId1>,<tabId2>]" [--primaryTabId <id>] [--sessionId <id>] [--focus]

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file includes a natural-language example description in Chinese ("提取数据") while the rest of the document is in English. Because no user opt-in or locale justification is provided, this can be read as implicitly forcing or normalizing a specific language, which may conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file contains natural-language guidance and examples that normalize Chinese-language names, descriptions, and field content for generated playbooks. Because the policy category applies to all file types, this can be flagged as a locale/language preference that is not paired with explicit user opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The example hard-codes https://www.baidu.com, and later examples use Chinese-language content values, which nudges agents toward a specific language/locale context without stating that this is optional or region-specific. Under the policy, forcing or implying a specific locale without user choice can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.