Security audit

Agent Browser

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate browser automation skill, but it needs review because it can handle and persist login/session data with under-scoped privacy guidance.

Install only if you need full browser automation. Avoid using real browser profiles or production accounts unless necessary, treat saved state and recordings like credentials, do not commit them, prefer temporary isolated sessions, and review any use of eval, file://, proxy credentials, or custom extensions before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill description is broadly scoped to general browsing, testing, form filling, screenshots, and extraction, which overlaps with many common user intents and can cause the agent to invoke a powerful browser-capable skill more often than necessary. Because this skill can access arbitrary URLs, interact with forms, and extract page content, over-activation increases the chance of unintended data access, unsafe navigation, or credential submission in contexts where a narrower tool would suffice.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation explicitly states that recording preserves cookies and storage from the current session, and elsewhere exposes commands for cookies, storage, session reuse, and saved auth state, but it does not provide strong privacy warnings or consent boundaries. In practice this can lead to unintentional retention, replay, or capture of authenticated state, tokens, personal data, or sensitive browsing artifacts across sessions and recordings.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The example instructs users to save authenticated browser state to a local file, which commonly contains session cookies or tokens that can grant account access if copied, committed, or reused. Although the document later mentions not committing state files, the example itself normalizes persistence of sensitive auth material without an immediate warning at the point of use.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The HTTP Basic Auth example demonstrates passing credentials directly in a command without an immediate warning about secret exposure, which can lead users to hardcode credentials, leak them into shell history, logs, transcripts, or process inspection, and reuse unsafe patterns. In an automation skill focused on browser actions, this is more dangerous because the examples are likely to be copied verbatim into scripts and CI workflows.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The cookie example sets a session token directly without clearly warning that the token may be a bearer credential that grants immediate account access to anyone who obtains it. In this skill context, browser automation often involves screenshots, logs, saved state, and scripted reuse, which increases the chance of accidental disclosure or misuse of live session tokens.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation demonstrates embedding proxy usernames and passwords directly in environment-variable URLs, but does not warn that these secrets can be exposed through shell history, process listings, CI logs, debug output, or copied terminal transcripts. In an automation skill that encourages browser use against external sites, proxy credentials may grant access to paid proxy infrastructure or monitored corporate egress, so accidental disclosure can lead to unauthorized network use and traffic interception.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The rotating-proxies scraping example normalizes sending browsing traffic through third-party proxies and saving extracted page content to local files without warning about confidentiality, data handling, or compliance implications. In this skill context, the browser may access authenticated pages, sensitive forms, or internal data, so routing requests through untrusted proxies and persisting results locally can expose credentials, session data, or scraped content to unintended parties.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation shows recording a login workflow while filling an email and password, then saving the session to a persistent video file, but it does not warn that recordings may capture credentials, session data, PII, or other sensitive on-screen content. In a browser-automation skill, users are likely to apply these examples to real applications, so the omission can lead to accidental creation and retention of sensitive artifacts in local disks or CI systems.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.