tgebrowser

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:39 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent TgeBrowser automation skill, but it gives agents broad control over browser profiles, cookies, screenshots, fingerprints, cache, and deletion with weak confirmation guidance.

Install only if you intentionally want an agent to manage TgeBrowser profiles and automate browsing. Treat cookies, existing profiles, screenshots, fingerprint changes, cache clearing, and browser deletion as sensitive actions; require explicit user confirmation and profile selection before using them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

e Documentation

Reference docs with full enum values and field lists:

| Reference | Description | When to use |
|-----------|-------------|-------------|
| [references/environment-management.md](references/environment-management.md) | **open-browser**, **close-browser**, **create-browser**, **update-browser**, **delete-browser**, **get-browser-list**, **get-opened-browser**, **get-profile-cookies**, **get-profile-ua**, **close-all-profiles**, **new-fingerprint**, **delete-cache**, **get-browser-active** parameters. | Any browser environment operation (open, create, update, delete, list, cookies, UA, cache, status). |
| [references/group.md](references/group.md) | **get-group-list** parameters. | Listing browser groups. |
| [references/system.md](references/system.md) | **check-status** parameters. | Checking API availability. |
| [references/proxy.md](references/proxy.md) | **get-proxy-list** parameters. | Listing proxies. |
| [references/proxy-config.md](references/proxy-c

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly exposes a cookie-retrieval capability without any guardrails about user authorization, session sensitivity, or handling of authentication tokens. In a browser-automation skill, cookies can contain active session material and can be used to impersonate users or access third-party accounts, so documenting this as a routine utility meaningfully increases misuse risk.

Behavior Manipulation

Medium

• Category: Prompt Injection

Content

- List existing browsers first
- If found, use the most recently created one
- If none exist, create one with defaults
- Always prefer reusing existing browsers over creating new ones

**Scenario 4: Automation fails**
- Check connection status first

• Confidence: 80% confidence
• Finding: The instruction to prefer reusing existing browsers over creating new ones can cause the agent to act within an already-authenticated profile belonging to a different task or user context. In this skill, that raises the risk of unauthorized access to stored sessions, cookies, history, and active accounts, making cross-context data exposure more likely.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill instructs the agent to auto-generate screenshot paths and create directories without warning that this writes potentially sensitive page contents to local disk. Screenshots may capture credentials, personal data, or confidential business information, and silent persistence increases the chance of unintended data retention or later disclosure.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This markdown file hard-codes contested or policy-sensitive naming such as "China Hong Kong" (L099), "China Macao" (L152), and "China Taiwan" (L231) rather than offering neutral alternatives or user-selected locale conventions. That creates a natural-language locale/policy issue because the skill imposes a specific geopolitical naming convention without opt-in or documented justification.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This markdown file describes a delete operation for browser environments but does not warn that the action may remove user data or be irreversible. Under the markdown criteria, destructive behaviors that affect user data or system state should include a clear warning to the user.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation states that all opened browser environments on the current device will be closed, but it provides no caution about interrupting active sessions or losing unsaved work. This is a system-impacting operation and should be disclosed in the skill description.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The file documents clearing local cache and notes only that the browser should be closed first, but it does not warn that cache deletion may remove local state or sign users out. For markdown files, behaviors affecting user data should be explicitly disclosed.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation describes locale- and geolocation-shaping options such as language, timezone, and IP-based geolocation behavior without any warning that these settings can materially affect identity presentation, compliance posture, and user privacy expectations. In a browser-control skill with anti-detection and fingerprint-management capabilities, omission of those warnings increases the likelihood of deceptive or policy-violating use.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The schema permits setting fingerprint.language without any indication of user choice, transparency, or policy constraints, which can facilitate deliberate browser fingerprint spoofing. In the context of a tool explicitly designed for browser environment management, proxies, and automation, this increases the risk of impersonation, account evasion, or deceptive automation at scale.

Vague Triggers

Low

• Confidence: 85% confidence
• Finding: This JSON manifest describes multiple tools and their purposes, but it does not provide any explicit trigger phrases, activation constraints, or negative examples clarifying when these tools should or should not be invoked. For manifest files, that lack of specificity can make invocation behavior overly broad or ambiguous in agent systems that rely on tool descriptions for routing.

Static analysis

No suspicious patterns detected.