Security audit

Browser Use

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate browser automation skill, but it gives agents broad access to logged-in browser sessions, cookies, cloud profile syncing, raw browser internals, and public tunnels without enough safety boundaries.

Install only if you need a powerful browser automation bridge and trust the external browser-use CLI. Prefer isolated or temporary browser profiles, avoid syncing personal profiles to cloud, treat cookies and API keys as credentials, require explicit approval before using authenticated profiles or tunnels, and close sessions plus stop tunnels when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill exposes Cloudflare tunneling operations that extend beyond the declared browser-automation scope and can publish local services to the internet. In an agent setting, this creates unnecessary network-exposure capability that could be abused to exfiltrate data, expose internal apps, or bypass expected access boundaries.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The documented cloud REST passthrough and account-management functions broaden the skill from browser automation into generic remote-service control. That expanded capability can let an agent create/manage remote browser resources or accounts and interact with external APIs in ways users may not expect, increasing the attack surface and opportunity for unauthorized actions.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The reference explicitly exposes internal primitives, including browser._run(coroutine) and browser._session, which grant full raw CDP and browser-session control beyond ordinary page automation. In a browser automation skill, this meaningfully expands capability to low-level browser control, data access, and potentially stealthier actions than the manifest suggests, increasing the chance of misuse or privilege overreach.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The documentation advertises network interception as an available use of raw CDP, but that capability is not necessary for the stated purpose of web testing, form filling, screenshots, and extraction. Interception can enable capture or manipulation of requests, headers, and tokens, expanding the skill into sensitive traffic inspection territory without clear justification or safeguards.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The recipe shows direct retrieval of browser cookies via CDP, which can expose authentication material and session secrets unrelated to the user's immediate task. In the context of a browser-use skill, this is especially dangerous because cookies can permit account takeover or cross-site session abuse if accessed or logged improperly.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly supports connecting to the user's existing Chrome profile, preserving logins and cookies, but does not provide a strong privacy warning or consent boundary. In practice this grants access to authenticated sessions and sensitive browsing data, which can enable account misuse, data extraction, or actions performed as the user.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Cookie export/import functionality handles highly sensitive session material, yet the skill does not warn that exported cookies may allow session hijacking or unauthorized account access if mishandled. In an automation context, this materially increases the risk of credential theft, cross-session impersonation, and unsafe storage of secrets.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill documents saving a cloud API key and using environment-variable credentials without clearly warning that these are secrets with account-level consequences. This can lead agents or users to persist credentials insecurely, leak them through logs or shell history, or perform unintended billable or privileged cloud actions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The example not only retrieves cookies but prints them directly, creating a straightforward path to accidental disclosure in logs, transcripts, or downstream tooling. Because cookies often contain session identifiers, exposing them in plaintext materially increases the risk of credential theft and unauthorized account access.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.