Stagehand Browser Tool Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:34 AM UTC
• Version: 1.0.1

Overview

This browser-automation skill is mostly coherent, but it asks users to install and globally expose an unreviewed npm tool while under-explaining sensitive browser actions and data-sharing paths.

Review this skill before installing. Use it only in an isolated environment, avoid sensitive accounts or private pages until the publisher supplies reviewed package files and dependency locks, and require explicit confirmation before form submits, purchases, uploads, messages, or callback_url use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:173

Finding

Unverifiable npm Dependency Installation and Global Command Registration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 173–182
Vulnerability Type: Unverified third-party dependency installation and global executable exposure
Risk Level: Medium

Vulnerable Code

bash

cd ~/.skill-platform/workspace/skills/stagehand-browser-tool-free
npm install
npm link
browser --version

Technical Analysis

The skill directs the user or agent to run npm install and npm link, but the audited artifact contains no package.json, package lockfile, dependency version list, source code, or integrity information. The contents and provenance of the package expected at the specified directory therefore cannot be verified from this project.

An npm installation can execute package lifecycle scripts, including preinstall, install, and postinstall, under the privileges of the invoking user. Unpinned or otherwise unreviewed dependencies can also expose the installation to dependency substitution, compromised package releases, or malicious transitive dependencies.

The subsequent npm link operation exposes the package's executable entry points through the applicable npm global prefix. This expands the consequences of a compromised package because an unreviewed executable named browser may become available through the user's command search path.

This finding does not establish that a malicious dependency is currently present. It establishes that the documented bootstrap procedure requires execution and global exposure of package content that is absent from, and therefore unverifiable within, the audited artifact.

Attack Path

1. A user or AI agent follows the initialization instructions in SKILL.md.
2. The expected skill directory is populated with a package containing compromised dependencies or malicious npm lifecycle scripts.
3. The user runs npm install.
4. npm resolves the unspecified dependency graph and may execute package lifecycle scripts with the user's ...[truncated 1179 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete implementation, package.json, and package lockfile in the reviewed project.
2. Pin direct and transitive dependencies to reviewed versions through a committed lockfile.
3. Use npm ci rather than npm install to enforce deterministic resolution.
4. Use npm ci --ignore-scripts when lifecycle scripts are unnecessary. If scripts are required, document and audit every lifecycle script before execution.
5. Record dependency provenance and verify package integrity through registry integrity metadata, checksums, or signed release artifacts.
6. Run dependency auditing and software-composition analysis before distribution.
7. Avoid npm link for normal installation. Prefer a project-local executable invoked through a controlled package script or npx --no-install.
8. If global command registration is essential, document the exact binary entry point and verify that it cannot shadow an existing trusted command.
9. Perform installation in a least-privileged, isolated environment without sensitive credentials or unnecessary filesystem access.
10. Revise the documentation so users are not instructed to execute installation commands until all required package files and reviewed dependency metadata are included.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation/use-case language is broad and inconsistent, spanning browser automation plus unrelated analytics/reporting scenarios. Overbroad triggers increase the chance the agent invokes this skill in contexts the user did not intend, leading to unnecessary browser actions, data extraction, or external side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises clicking buttons, filling forms, and submitting data but does not clearly warn that these actions can change external systems, create accounts, send messages, or disclose user information. In a browser-automation context, omission of this warning materially increases the risk of harmful real-world side effects from misunderstood or over-broad instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Documenting a callback_url without warning that results may be transmitted to an external endpoint hides a meaningful exfiltration path. Extracted page content, logs, or task results could be sent to attacker-controlled infrastructure if users assume the tool is purely local/private.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill claims data stays local and implies no external data disclosure, yet it also declares an LLM API as a required dependency. This inconsistency can mislead users into sharing sensitive page contents or browser-derived data under the false assumption that nothing leaves the machine.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The keyword coverage section enumerates highly generic scenario terms rather than precise invocation phrases. In an agent environment, this raises the risk of unintended activation during ordinary discussion of analysis, reporting, or automation topics, causing the skill to perform browser operations when not explicitly requested.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The API key/privacy section says no extra API key is needed and all data is processed locally, but the dependency section says an LLM API is required. This creates a deceptive privacy boundary and may cause users to automate browsing or extraction on sensitive sites without understanding that data could be sent off-device.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.