Security audit

Browser Use.Conflict

Security checks across malware telemetry and agentic risk

Overview

This skill is a real browser automation wrapper, but it exposes powerful code execution, account/session, cloud, and public-tunnel capabilities that are broader than its short description makes clear.

Install only if you need the full browser-use CLI surface and trust the external CLI. Prefer isolated browser profiles, avoid cookie export/import and profile sync unless explicitly needed, do not run browser-use python on untrusted code, treat cloud API keys as secrets, and use tunnels only for services you are comfortable exposing publicly and can promptly shut down.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as browser automation and data extraction, but it also exposes arbitrary Python execution with a persistent namespace tied to the browser session. That materially expands capability beyond the declared scope and can enable arbitrary local actions, secret handling, or unsafe automation paths that a caller may not anticipate from the manifest.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest frames the skill as browser interaction, but the documented cloud API features include account login, browser provisioning, and generic REST passthrough. This creates scope mismatch and may let the skill perform external API operations beyond ordinary browsing, increasing the chance of unauthorized remote actions or data transfer.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The tunnel feature can expose arbitrary local ports to the public internet via Cloudflare, which is a major capability escalation unrelated to routine browser automation. If misused, it can publish internal development services or administrative interfaces and create direct external access to local resources.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation language is very broad and can cause this skill to be selected for many generic browsing or information-retrieval requests. Because the skill also includes sensitive capabilities like profile use, cookie manipulation, cloud operations, Python execution, and tunneling, overbroad activation increases the risk that a powerful tool is invoked in contexts where a narrower, safer tool would suffice.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation includes sensitive operations involving real browser profiles, cookies, cloud login/provisioning, and local tunnels without prominent warnings about privacy, credential exposure, session hijacking, billing, or system/network impact. In this context, the absence of clear guardrails makes accidental misuse significantly more likely, especially when combined with authenticated profiles and export/import capabilities.

VirusTotal

53/53 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.