Browser Use

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:43 AM UTC
• Version: 2.0.1

Overview

This browser automation skill is mostly coherent, but it gives agents several sensitive powers that are not clearly warned about or scoped for users.

Install only if you are comfortable letting an agent control browser sessions and potentially authenticated accounts. Avoid using real Chrome profiles, cookie export/import, `profile sync --all`, raw CDP cookie/network commands, and `tunnel <port>` unless you explicitly intend that access; tunneling can make a local service reachable from the internet.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill advertises website interaction but also includes the ability to expose local ports to the public internet through tunnels. This is a materially different and riskier capability that can publish internal development services or private data to external parties if invoked improperly.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The tunnel feature exposes a local service to the public internet, which can unintentionally publish private applications, data, or admin interfaces. Omitting a strong warning in a skill meant for browser automation makes accidental high-risk exposure more likely.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Local tunnel creation is not necessary for ordinary browser automation and creates a direct path for exposing local services externally. In an agent context, this can turn a browsing helper into a network publication mechanism with significant security consequences.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Profile sync can upload browser profiles that may contain browsing history, cookies, tokens, and saved credentials to a cloud service. Without prominent disclosure and consent, this creates a serious privacy and account-compromise risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Connecting to the user's existing Chrome profile grants access to active logins, cookies, and browsing context, allowing the agent to act as the user on authenticated sites. Without explicit risk disclosure and consent, this can lead to privacy violations or unintended account actions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Cookie retrieval, export, import, and clearing directly manipulate sensitive session material that can disclose or alter authenticated state. Documenting these operations without clear safeguards increases the risk of session theft, account disruption, or unintended data exposure.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as browser automation, but it also exposes cloud account provisioning and arbitrary REST passthrough to an external service. That expands capability beyond the declared purpose and can enable unreviewed outbound actions, data transfer, and account creation without clear user awareness.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The cloud API section permits saving API keys locally and sending requests to an external service, but does not clearly disclose credential persistence or remote data transmission. Users may unknowingly store secrets on disk or exfiltrate browsing-related data to third-party infrastructure.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The reference explicitly advertises browser-level control beyond ordinary web automation, including network interception and direct Chrome target manipulation. In a skill presented as browser automation for testing and form filling, exposing these undocumented privileged capabilities materially expands what an agent can access and manipulate, including sensitive traffic and session state.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Network interception is a powerful surveillance and tampering capability that exceeds the stated browser automation purpose and can capture credentials, tokens, request bodies, or alter traffic in flight. Even though only mentioned as a use case here, documenting and normalizing that capability without strong justification increases the likelihood of misuse.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: Documenting browser._run(coroutine) and browser._session gives callers arbitrary access to internal browser session objects and async execution, effectively bypassing any higher-level safety boundaries the CLI may impose. That turns the skill from constrained browser automation into a general-purpose privileged browser control surface.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The documentation includes a recipe for retrieving cookies through CDP, which can expose authentication tokens and other session secrets. Because the skill description does not disclose secret extraction capability, this creates a significant confidentiality risk and enables account/session compromise if misused.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The cookie access example presents sensitive session data extraction as a normal operation and does so without any warning about the confidentiality implications. In the context of a browser automation skill, this lowers the barrier to exfiltrating secrets and may mislead users about the sensitivity of the operation.

Static analysis

No suspicious patterns detected.