Shah lABS

• Outcome: Review
• Latest audit: May 28, 2026 · 3:42 PM UTC
• Version: 1.0.0

Overview

This appears to be a real browser automation skill, but it gives agents broad control over logged-in browser sessions and sensitive saved browser data with weak default limits.

Install only if you trust the external agent-browser CLI and need agent-level browser control. Use test accounts or dedicated browser profiles, enable domain allowlists/content boundaries/action policies, avoid importing your everyday browser session, confirm before login, payment, posting, or other state-changing actions, and treat saved state, screenshots, recordings, traces, HARs, and proxy credentials as secrets. Avoid proxy rotation for rate-limit or ban avoidance.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger language is extremely broad and would cause this skill to activate for many generic browsing or website-related requests, increasing the chance an agent invokes a powerful browser automation tool unnecessarily. In this skill, overbroad routing is risky because the tool can navigate arbitrary sites, interact with forms, and access authenticated sessions, so accidental invocation expands exposure to prompt injection, privacy leakage, and unintended actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly states that security features are opt-in and that, by default, the tool imposes no restrictions on navigation, actions, or output, while also describing handling of plaintext session state, imported browser auth, clipboard access, local files, network capture, and JS evaluation. Without an upfront warning and safer defaults, an agent may use this skill in ways that expose credentials, session tokens, sensitive page data, or perform impactful actions on third-party sites.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documented commands include handling of cookies, localStorage, HTTP basic auth credentials, and saved auth state without any warning about secret exposure, persistence, or secure storage. In an agent-facing browser automation skill, this increases the chance that users or downstream agents will persist sensitive authentication material to disk or output it to logs, enabling account takeover or session hijacking if mishandled.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Screenshot, PDF, video, trace, and profile commands can capture full page contents, including personal data, credentials, tokens rendered in the UI, and internal application details, then write them to disk. Without warnings, users may unintentionally create persistent sensitive artifacts that can later be exfiltrated, shared, or committed to source control.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This documentation tells users how to capture and save Chrome performance traces but does not warn that trace files can include sensitive information such as visited URLs, timing data, user interactions, page structure details, and application-specific markers. In an agent-browser context, traces may be generated during authenticated sessions or while interacting with internal apps, increasing the chance that the JSON output is later mishandled, shared, or committed to source control.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation shows authenticated proxy URLs with embedded usernames and passwords, but does not warn that credentials placed in environment variables or shell commands may be exposed through shell history, process listings, logs, screenshots, or copied configs. In an agent-browser context, this is more dangerous because the skill is explicitly designed for automation and operators may copy these examples into scripts or shared environments, turning documentation into insecure operational practice.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation shows saving and loading browser session state that includes cookies and storage, which can contain active authentication tokens and other sensitive data. In an agent-browser skill, this is materially risky because users may copy these examples directly and persist reusable authenticated state without understanding that the file effectively functions like a credential.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The authenticated session reuse example combines environment-sourced credentials with saving a reusable auth-state file, but does not foreground the sensitivity of either the credentials or the persisted session. This can normalize insecure operational patterns where long-lived session artifacts are stored in predictable locations and reused by other processes or users.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation includes concrete examples for filling email/password fields and submitting a login form using realistic-looking credentials, but it does not warn that browser automation may act on real accounts, handle secrets, or trigger irreversible side effects. In an agent-browser skill, such examples normalize autonomous credential entry and submission, increasing the chance an agent will perform sensitive actions without confirming user intent or using redacted/test data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The iframe example demonstrates entering card data and clicking a Pay button without any warning that this could process a real payment, expose PCI-regulated data, or interact with third-party payment providers. In a browser automation skill, this is more dangerous because agents are explicitly being taught to operate real web interfaces, so omission of transaction-safety guidance can lead to unauthorized purchases or mishandling of payment information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation strongly encourages recording browser sessions, screenshots, and CI artifacts but never warns that these captures can include secrets, personal data, session details, or other sensitive on-screen content. In an agent-browser skill, this is more dangerous than generic documentation because the tool is explicitly used for logins, form filling, app testing, and CI automation, all of which commonly expose credentials and sensitive business data that may then be written to disk or retained in shared artifact stores.

Static analysis

No suspicious patterns detected.