Security audit

agent-browser-cli

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is mostly disclosed, but it promotes bypassing anti-crawler protections and has broad, under-scoped authority for real browser actions.

Review this skill carefully before installing. Use it only for sites and accounts where you are authorized to automate actions, avoid anti-bot or anti-crawler bypass features, and require explicit confirmation before submitting forms, changing account settings, exporting data, or running system commands.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill advertises anti-crawler bypass as a product capability even though no concrete implementation is shown. In a browser-automation skill, normalizing evasion of website defenses encourages potentially abusive use and misrepresents the tool's behavior, which can lead operators to attempt policy-violating automation against third-party services.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The FAQ explicitly instructs users to use an `--anti-crawler-bypass` parameter that is not otherwise defined, which both fabricates capability and provides guidance for bypassing site protections. This is dangerous because it frames evasion of anti-abuse defenses as an accepted workflow in a browser automation skill likely to be used against external websites.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest and early description position the skill as browser automation, but later sections broaden it to generic file handling, API integration, and system command execution. This scope expansion is dangerous because it increases privilege expectations and can cause an agent or user to invoke the skill for far more powerful operations than its declared purpose suggests.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger language is broad enough that the skill may be invoked whenever a user mentions efficiency, automation, or browser tasks, without clear boundaries. For a skill that can control a browser and potentially interact with real accounts and forms, over-broad activation increases the chance of unintended or unsafe execution.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The capability overview presents incomplete and ambiguous activation conditions, making it unclear when the skill should or should not run. In an automation context, such ambiguity can cause accidental use on sensitive workflows like sign-ins, form submissions, or account actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill promotes automating sign-ins, form filling, clicks, and other browser interactions without prominently warning that these actions can affect user accounts, submit data, or trigger external side effects. This omission is dangerous because users may treat the skill as low-risk convenience tooling despite its ability to perform consequential actions on live systems.

Ssd 2

Medium

Confidence: 97% confidence
Finding: Describing anti-crawler evasion as a standard premium feature directly promotes bypassing third-party defensive controls. In the context of an agent-driven browser automation skill, this materially increases misuse risk by encouraging scraping or automation against targets that are actively trying to prevent it.

Ssd 2

Medium

Confidence: 98% confidence
Finding: The FAQ gives direct natural-language guidance on how to automatically bypass anti-crawler protections, which is effectively operational advice for defeating defensive controls. Because this skill is specifically built to automate browser actions, that guidance is more dangerous than generic discussion: it can be readily applied to real targets with minimal additional work.

Static analysis

No suspicious patterns detected.