Security audit

Browserless Agent

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate browser automation skill, but it gives an agent broad control over websites, browser session data, and saved page captures without enough scoping or consent guidance.

Install only if you intend to give the agent broad browser-control authority. Prefer a dedicated or self-hosted Browserless instance for sensitive work, keep BROWSERLESS_TOKEN in secure secret storage, use wss:// for remote services, and require explicit confirmation before uploads, submissions, cookie/localStorage reads, custom auth headers, screenshots/PDFs of private pages, or arbitrary JavaScript evaluation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill exposes network access and consumes environment variables (`BROWSERLESS_URL`, optionally `BROWSERLESS_TOKEN`) but does not declare permissions explicitly. This creates a transparency and governance gap: users or platforms may not realize the skill can reach arbitrary remote browser infrastructure and use sensitive connection material, increasing the risk of unintended data exposure or misuse.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill exposes arbitrary JavaScript execution in the context of whatever site the browser is visiting via `page.evaluate(...)` and `page.evaluate(function, args)`. In an agent setting, this goes beyond ordinary navigation/scraping and can be used to bypass higher-level safety controls, manipulate authenticated pages, extract sensitive DOM data, or trigger privileged actions on sites the user is logged into.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The changelog documents actions that can navigate sites, fill forms, click buttons, upload files, modify storage, and otherwise change browser/session state, but it does not warn users that these operations may affect third-party services or perform real state-changing actions. In an agent skill for autonomous browser automation, that omission increases the chance of unintended transactions, account changes, consent clicks, or data submission when the skill is used on live websites.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README includes form automation and submission examples without an explicit warning that these actions can trigger real external side effects such as sending messages, submitting surveys, creating records, or performing unintended transactions on third-party sites. In the context of an agent skill designed for autonomous browser interaction, omission of this warning increases the risk that users or downstream agents treat examples as harmless read-only automation when they are actually state-changing.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The feature list advertises powerful browser automation capabilities such as navigation, form filling, file upload, storage access, and network control, but does not warn users that these actions can affect privacy, account state, or external systems. In a browser automation skill, omission of these warnings is meaningful because the skill can interact with authenticated sessions, submit forms, and change remote state on behalf of the user.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill includes `evaluate` and `evaluate_function`, which execute arbitrary JavaScript in the page context, yet provides no warning about the risks. This is dangerous because page-context execution can read page state, scrape sensitive data visible to the session, manipulate application behavior, and help bypass normal guardrails by running custom logic directly inside a loaded site.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Cookie and storage operations can read, set, and delete browser state without any warning to the user. In the context of a browser automation skill, this can expose session identifiers, alter authentication state, persist tracking or malicious values, and destroy data needed for account integrity or reproducibility.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The `set_extra_headers` capability allows injection of arbitrary HTTP headers, including authorization material, but the documentation lacks warnings about credential leakage, impersonation, and request tampering. Combined with arbitrary navigation and remote Browserless infrastructure, this can cause secrets to be sent to unintended hosts or used to perform privileged actions against third-party services.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: `get_cookies` returns all cookies from the current browser context without any consent, filtering, or masking. In a browser automation skill, this can expose session identifiers or authentication material from logged-in sites, enabling account takeover or unauthorized reuse of browser state.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: `get_local_storage` reads arbitrary keys from site localStorage with no warning or restrictions. Local storage often contains tokens, user identifiers, app state, or API credentials, so exposing it directly can leak sensitive data from authenticated web applications.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The screenshot function accepts an arbitrary filesystem `path` and writes captured content there. This permits uncontrolled file creation/overwrite in the execution environment and can persist sensitive page contents, including authenticated pages or PII, to disk without clear disclosure.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The PDF generation function similarly writes arbitrary page content to an attacker-controlled `path`. Besides filesystem overwrite risk, PDFs can store sensitive rendered information from private sessions and create durable artifacts that outlive the browser session.

Unpinned Dependencies

Low

Category: Supply Chain
Content: playwright
Confidence: 95% confidence
Finding: playwright

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.