Security audit

Stagehand Browser Tool Free

Security checks across malware telemetry and agentic risk

Overview

This browser-automation skill is not clearly malicious, but it needs review because it can perform real website actions while privacy and external-callback behavior are under-explained.

Install only if you are comfortable with an agent controlling a local Chrome session. Use it on non-sensitive pages first, confirm any login, purchase, posting, or form submission yourself, and avoid callback_url or sensitive page extraction unless you understand where the data will go.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims that all data stays local and that no extra API key is needed, yet later declares an external LLM API as a required dependency. This mismatch can mislead users into exposing browsing content, extracted data, or prompts to a remote service under false privacy assumptions. In a browser-automation skill, that context increases risk because the tool may process sensitive page contents, form data, or session-derived information.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The activation conditions are broad and inconsistent with the skill's actual browser-automation purpose, making it more likely the agent will invoke the skill in inappropriate contexts. Because the skill has exec-backed automation and browser interaction capabilities, over-triggering can lead to unintended navigation, extraction, or actions on external sites without strong user intent confirmation.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The capability coverage section defines a very wide keyword trigger surface without meaningful constraints. In an agent environment, this increases the chance of accidental invocation of a tool that can read pages, automate interactions, and use exec, which can expand the blast radius of prompt-routing mistakes or ambiguous requests.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill advertises clicking, form filling, and submission capabilities but does not prominently warn that these actions can modify external systems or send user data to third-party sites. In browser automation, this omission is materially dangerous because users or calling agents may treat the tool as passive when it is capable of real-world state changes.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Documenting a callback_url without warning users that results may be sent to an external endpoint creates a clear data-exfiltration risk. Given this skill extracts webpage content and may process sensitive information, silent or poorly explained callbacks could leak private data, credentials-adjacent information, or proprietary content to attacker-controlled infrastructure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.