Security audit

Agent Browser

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate browser automation skill, but it grants broad browser control and normalizes sensitive session persistence and proxy-based scraping patterns that users should review before installing.

Install only if you need broad browser automation and trust the separate agent-browser binary on your machine. Use test or least-privilege accounts, avoid proxy rotation to bypass site rules, protect saved state files like passwords, do not commit screenshots, recordings, PDFs, or auth-state files, and use --ignore-https-errors only for controlled local testing.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The documentation explicitly recommends rotating proxies to avoid rate limiting for scraping, which promotes an evasion technique beyond ordinary browser testing or form automation. In the context of an agent browser skill, this can facilitate large-scale scraping through third-party infrastructure and normalize bypassing website defenses.

Intent-Code Divergence

Low

Confidence: 81% confidence
Finding: The file's best-practices section advises not to hardcode proxy credentials, but earlier examples embed usernames and passwords directly in proxy URLs. This inconsistency can lead users to copy insecure patterns that expose secrets in shell history, process listings, logs, and shared documentation.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation advertises screenshots, PDFs, and recordings being saved to disk, but does not clearly warn that these artifacts may contain sensitive page contents, tokens, personal data, or proprietary information. In an agent setting, silent local persistence increases the chance of unintended data retention and later disclosure.

Missing User Warnings

High

Confidence: 97% confidence
Finding: Saving authentication state to a file can persist session cookies, tokens, and other credentials that may allow account takeover if the file is exposed. The example normalizes this workflow without warning about secret handling, encryption, file permissions, expiration, or secure deletion, making misuse more likely.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Documenting `--ignore-https-errors` without a warning encourages bypassing certificate validation, which weakens transport security and can expose users to man-in-the-middle attacks. In a browser automation tool, this is especially risky because agents may submit credentials or scrape sensitive content from hosts whose identity is no longer being verified.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The example instructs users to save authenticated browser state to a local file immediately after login, and the nearby example text does not warn inline that the file contains reusable session cookies or tokens. If that file is copied, committed, or reused by another party, it can enable authenticated access without re-entering credentials.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The OAuth example saves post-login browser state to disk after completing a third-party authentication flow, which may persist session cookies and other bearer-style authentication artifacts. Without an inline warning, users may treat the output as harmless test data and inadvertently expose reusable authenticated access.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Saving state after a successful 2FA flow can preserve a fully authenticated session that may bypass future login challenges when reloaded. If the file is stolen or reused, it can weaken the protection intended by multi-factor authentication by granting access through the persisted session.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The authenticated proxy examples place credentials directly in environment-variable values and URLs without warning about leakage risks. In practice, these secrets may be exposed via shell history, debugging output, CI logs, crash reports, or other tooling that captures environment settings and command context.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The rotating proxy scraping example routes requests and extracted page content through third-party proxies but omits any warning that those intermediaries can observe destinations, metadata, and potentially sensitive retrieved data. Because this skill automates browsing and extraction, users may unknowingly transmit internal targets or collected content to untrusted proxy operators.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation encourages recording full browser sessions, including login and form-filling flows, but does not warn that videos may capture credentials, session data, personal information, or other sensitive page contents. In this skill context, that omission is more dangerous because the examples explicitly demonstrate entering email and password fields and saving recordings to disk, which can create persistent sensitive artifacts that may later be accessed, uploaded, or retained insecurely.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.