Browser Use.Conflict

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:22 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is not clearly malicious, but it gives broad access to real browser sessions, cookies, cloud sync, public tunnels, and arbitrary Python execution beyond its short description.

Install only if you trust the browser-use CLI and need these advanced features. Use an isolated browser profile, avoid personal default profiles, do not export cookies or sync profiles unless necessary, treat tunnels as public internet exposure, and avoid putting API keys directly in commands or prompts.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:4
• Finding: Overly Broad Tool Permission Exposes Arbitrary Execution and Authenticated Browser Data## Vulnerability Details **File Location**: `SKILL.md:4` **Related Capability Locations**: `SKILL.md:33,69,85,89,130,154` **Vulnerability Type**: Excessive tool permissions and access to sensitive browser sessions **Risk Level**: High ### Vulnerable Code ```yaml allowed-tools: Bash(browser-use:*) ``` The unrestricted permission includes sensitive commands documented elsewhere in the file: ```bash browser-use --profile "Default" open <url> browser-use eval "js code" browser-use cookies export <file> browser-use python "code" browser-use profile sync --all ``` ### Technical Analysis The wildcard in `Bash(browser-use:*)` authorizes every `browser-use` subcommand rather than limiting the Skill to the navigation and form-interaction functions described by its primary purpose. The authorized command surface includes: - Persistent arbitrary Python execution through `browser-use python`. - Arbitrary JavaScript execution in a page context through `browser-use eval`. - Access to real Chrome profiles containing existing logins and cookies. - Export of browser cookies to local files. - Synchronization of browser profiles to cloud infrastructure. These capabilities violate least privilege because ordinary navigation, screenshots, and form filling do not inherently require arbitrary Python execution, cookie export, or cloud profile synchronization. The audit did not identify an embedded malicious payload, but an untrusted task or maliciously influenced agent could misuse the exposed capabilities. ### Attack Path 1. A user or untrusted instruction causes the Skill to operate against an authenticated browser profile. 2. The Skill invokes `browser-use --profile "Default" open ...`, gaining access to an existing authenticated browser session. 3. The attacker directs the agent to inspect account information, execute Python or page JavaScript, or export cookies. 4. Session data is written to a local file with `browser-use cookies export` or transferred us ...[truncated 854 chars]
• Remediation: ## Remediation Suggestions - Replace `Bash(browser-use:*)` with an explicit allowlist containing only the commands required for navigation, state inspection, screenshots, and basic interaction. - Exclude `python`, `eval`, cookie export, profile synchronization, cloud login, and tunnel commands from the default permission set. - Use a dedicated, isolated browser profile without personal cookies, saved credentials, or existing authenticated sessions. - Require explicit, informed user confirmation before accessing a real Chrome profile or exporting any browser data. - Disable cloud synchronization by default and require a separate, narrowly scoped permission for each transfer. - Run the browser automation process in a sandbox with restricted filesystem, environment-variable, process, and network access. - Record and clearly display sensitive operations so users can review profile access, cookie handling, and external transfers.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:120
• Finding: Local Services Can Be Exposed Publicly Without Documented Access Controls## Vulnerability Details **File Location**: `SKILL.md:120` **Related Workflow Location**: `SKILL.md:169-170` **Vulnerability Type**: Unprotected public tunneling of local services **Risk Level**: Medium ### Vulnerable Code ```bash browser-use tunnel <port> # Start Cloudflare tunnel (idempotent) ``` The documented example exposes a local development service: ```bash browser-use tunnel 3000 # → https://abc.trycloudflare.com browser-use open https://abc.trycloudflare.com # Browse the tunnel ``` ### Technical Analysis The Skill documents a command that creates a Cloudflare tunnel to an arbitrary local port. The instructions do not require authentication, source restrictions, service classification, confirmation of the selected port, or a maximum tunnel lifetime. A local service may have been designed under the assumption that it is reachable only from the local host. Development servers commonly contain debug interfaces, administrative routes, source maps, test data, or endpoints without production-grade authentication. Publishing such a service through a tunnel changes its trust boundary and can make it reachable from the public internet. ### Attack Path 1. A sensitive service is listening on a local port, such as a development dashboard, debug server, database administration interface, or internal API. 2. An untrusted instruction persuades the agent to run `browser-use tunnel` for that port. 3. Cloudflare assigns a publicly reachable URL to the local service. 4. The URL is disclosed through command output, logs, browser activity, or another communication channel. 5. A remote party accesses the service and exploits its unauthenticated or weakly protected functionality. 6. The attacker retrieves data or performs actions available through the exposed local service. ### Impact Assessment The impact depends on the service bound to the selected port. Exposure could permit unauthorized access to developm ...[truncated 308 chars]
• Remediation: ## Remediation Suggestions - Require explicit user confirmation that identifies the exact port, local service, public exposure, and expected tunnel lifetime. - Validate that the selected service is intended for external access before creating a tunnel. - Add authentication and authorization in front of every tunneled service. - Use short-lived tunnels and stop them automatically when the browser task finishes. - Restrict access by identity or source network where supported. - Prohibit tunneling administrative interfaces, debug servers, databases, metadata endpoints, and services containing sensitive information. - Display the active tunnel list during cleanup and ensure `browser-use tunnel stop --all` is executed. - Avoid printing or transmitting public tunnel URLs beyond the intended user and workflow.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:107
• Finding: Cloud API Key Is Accepted as a Command-Line Argument## Vulnerability Details **File Location**: `SKILL.md:107` **Vulnerability Type**: Sensitive credential exposure through command-line arguments **Risk Level**: Medium ### Vulnerable Code ```bash browser-use cloud login <api-key> # Save API key (or set BROWSER_USE_API_KEY) ``` ### Technical Analysis The documented login method places the cloud API key directly in a command-line argument. Depending on the operating system, shell, agent framework, and logging configuration, command-line secrets may be exposed through: - Shell history. - Process listings and process-inspection interfaces. - Terminal capture and command transcripts. - Agent tool-call logs. - Debugging or telemetry systems. The alternative environment-variable method can also leak through process environments or diagnostics if it is not handled carefully. The documentation does not specify redaction, protected input, restricted credential-file permissions, or use of an operating-system credential store. ### Attack Path 1. A user follows the documented command and supplies a real cloud API key as the `<api-key>` argument. 2. The shell, agent runtime, or telemetry layer records the complete command. 3. Another local user, support operator, log reader, or compromised process retrieves the key from history, logs, or process metadata. 4. The attacker uses the key to authenticate to the cloud service. 5. The attacker consumes cloud resources or accesses browser and task data permitted by the compromised key. ### Impact Assessment A leaked key could allow unauthorized use of the associated browser-use cloud account. The precise scope depends on the key's server-side permissions, but it may include provisioning cloud browsers, submitting tasks, accessing browser resources, or incurring charges. Exposure remains valid until the key expires or is revoked.
• Remediation: ## Remediation Suggestions - Read the API key from protected standard input without echoing it. - Store the credential in an operating-system keychain or dedicated secret manager rather than in shell history or plaintext configuration. - Automatically redact credentials from command logs, agent transcripts, telemetry, and error messages. - If an environment variable must be supported, inject it only for the target process and prevent it from appearing in diagnostics or persisted environment files. - Store any local credential file with owner-only permissions. - Use short-lived, narrowly scoped credentials and provide straightforward rotation and revocation procedures. - Update the documentation to warn users not to place literal API keys in commands, prompts, scripts, or shared logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is presented as browser automation and data extraction, but it also exposes arbitrary Python execution with persistent state inside the browser-enabled environment. That materially broadens capability from constrained web interaction to general code execution, enabling filesystem access, secret handling, arbitrary network requests, and multi-step abuse that a user would not reasonably infer from the manifest.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The tunnel feature can publish a local service to the public internet, which is far broader than ordinary browser automation. If invoked carelessly or maliciously, it can expose development servers, internal tools, or unauthenticated local endpoints to external access, creating significant attack surface and possible data compromise.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The tunnel documentation omits that starting a tunnel exposes a local service to the public internet. In this skill context, that omission is especially dangerous because an automation-oriented user may treat it as a convenience feature, not realizing it can instantly make internal applications or test environments externally reachable.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Profile sync to the cloud is outside the declared browser automation use case and can transfer highly sensitive browser data, including cookies, session material, browsing state, and possibly stored profile artifacts. This creates a serious confidentiality risk because authenticated contexts may be replicated to a remote environment.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill recommends using real Chrome profiles for authenticated browsing without warning that this grants access to existing logged-in sessions, cookies, and sensitive browsing data. In context, this makes the skill more dangerous because browser automation can act as the user across already-authenticated sites and extract account data without additional login prompts.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The cloud API passthrough provides generic remote operations beyond simple browser interaction, including arbitrary REST-style requests to a backend service. This expands the trust boundary and can enable remote task submission or data transfer that is not disclosed by the skill's stated purpose, increasing the chance of misuse or unexpected exfiltration.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The cloud commands do not disclose that browsing activity, task contents, session data, or extracted page data may be transmitted to a remote service. Because users may assume local-only browser automation from the manifest, this omission increases the risk of unintended data disclosure across trust boundaries.

Static analysis

No suspicious patterns detected.