Long Research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:25 PM UTC
• Version: 1.2.0

Overview

This is a real long-research workflow, but it should be reviewed carefully because it can install and run browser automation, reuse logged-in browser profiles, send content to cloud or sub-agent providers, and keep broad local records.

Install only if you are comfortable with browser automation, local file writes, and possible third-party processing. Prefer Interactive mode, remove remote browser mode unless explicitly needed, avoid authenticated or sensitive sites, use an isolated browser profile and working directory, and pin/review the browser-use dependency before running install commands.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:375
• Finding: Mandatory Remote Browser Escalation Can Disclose Sensitive Authenticated Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-35, 375-411`; `references/browser-use-patterns.md:3-30` **Vulnerability Type**: Mandatory cloud transmission and excessive browser privileges **Risk Level**: High ### Vulnerable Code ```text **browser-use remote mode:** The browser-use cascade tries 3 modes in order: `chromium` (local, free) → `real` (local, free) → `remote` (cloud-hosted, burns API credits). Remote mode sends page content to browser-use.com's cloud infrastructure. ``` ```bash URL="https://example.com" SESSION="research" # Attempt 1: chromium (free) echo ">>> Trying chromium..." browser-use --session $SESSION --browser chromium open "$URL" 2>&1 | tail -5 # If "url:" appears in output → SUCCESS # Attempt 2: real (free) echo ">>> Trying real..." browser-use --session $SESSION --browser real open "$URL" 2>&1 | tail -5 # Attempt 3: remote (paid, last resort) echo ">>> Trying remote..." browser-use --session $SESSION --browser remote open "$URL" 2>&1 | tail -5 ``` ```text browser-use has 3 browser modes. You MUST try them in order. Do NOT give up after one failure. Run all 3 in sequence. Stop at the first success. ``` ### Technical Analysis The Skill explicitly acknowledges that remote mode sends page content to browser-use.com's cloud infrastructure. Nevertheless, its operational rules make the remote mode a mandatory escalation whenever both local modes fail. The Skill also supports login-gated forums and persistent browser profiles. Consequently, a URL opened during remote escalation may contain private posts, account-associated content, session-derived information, or sensitive research material. The privacy note says users can remove remote mode, but this conflicts with later mandatory instructions stating that all three modes must be tried “with no exceptions.” The behavior exceeds least privilege for ordinary research because local browsing or user-approved alternatives are sufficient in many cases. Remote processin ...[truncated 1236 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove remote mode from the default cascade. 2. Require explicit, per-URL user approval before invoking `--browser remote`. 3. Display the destination provider, affected URL, data categories, and potential cost before approval. 4. Prohibit the use of authenticated profiles, session cookies, or login-gated URLs in remote mode. 5. Create separate local and remote browser sessions so local authentication state cannot cross into the cloud session. 6. Redact sensitive query parameters and identifiers before remote navigation. 7. Permit the workflow to skip a blocked source or use an alternative source instead of requiring cloud escalation. 8. Make the privacy controls consistent with enforcement rules; remove all “no exceptions” language for remote mode. 9. Log whether remote processing occurred without recording page content, credentials, cookies, or sensitive URLs. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Unpinned Third-Party Package Installation Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14` **Vulnerability Type**: Mutable and unverified third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```text - **browser-use** (REQUIRED) — install via `pip install browser-use && browser-use install`. Used for JS-heavy sites, login-gated forums, and retailer pricing. The skill will not function fully without it. ``` ### Technical Analysis The installation command retrieves the latest available `browser-use` package and subsequently runs its installation command. It does not pin an audited version, verify package hashes, use a lockfile, or constrain transitive dependencies. Python package installation and package-provided setup commands can execute code with the privileges of the Agent or user running the installation. Because the effective dependency contents can change after the Skill has been reviewed, the audited Skill package does not fully determine the code that will execute. No evidence shows that the named package is itself malicious. The confirmed issue is the unsafe, mutable installation procedure and resulting supply-chain exposure. ### Attack Path 1. A user follows the dependency instructions. 2. `pip` resolves the current package and transitive dependencies from its configured index. 3. A compromised release, compromised dependency, unexpected future version, or maliciously configured package index supplies altered code. 4. Installation hooks, package code, or the subsequent `browser-use install` command executes that code locally. 5. The dependency gains the same effective permissions as the user or Agent process running the command. ### Impact Assessment A compromised dependency could potentially: - Read files accessible to the Agent account. - Access environment variables and locally stored API credentials. - Execute commands and modify files within the user's permission boundary. - Access browser profiles and persisted cookies. - Make arbitra ...[truncated 266 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `browser-use` to a specifically reviewed version. 2. Pin all transitive dependencies in a lockfile. 3. Verify packages using cryptographic hashes, such as `pip install --require-hashes`. 4. Document and enforce the expected package index rather than inheriting arbitrary user or environment configuration. 5. Install the dependency inside a dedicated virtual environment or container with minimal filesystem and network privileges. 6. Review the behavior and downloaded assets of `browser-use install`. 7. Avoid executing installation automatically during Skill invocation. 8. Publish a tested dependency manifest and update it only after security review. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:499
• Finding: Predictable Temporary File Is Sourced as Shell Code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:499-510` **Vulnerability Type**: Insecure temporary file handling and arbitrary shell-code sourcing **Risk Level**: High ### Vulnerable Code ```bash START_TS=$(date +%s) END_TS=$((START_TS + DURATION_SECONDS)) echo "START_TS=$START_TS" > /tmp/research_time echo "END_TS=$END_TS" >> /tmp/research_time echo "Deadline: $(date -d @$END_TS '+%H:%M:%S UTC')" ``` ```bash source /tmp/research_time NOW=$(date +%s) echo "Elapsed: $(( (NOW - START_TS) / 60 )) min | Remaining: $(( (END_TS - NOW) / 60 )) min" ``` ### Technical Analysis The workflow stores state at the fixed path `/tmp/research_time` and later executes the contents of that file through the shell `source` builtin. Shared temporary directories are normally writable by other local users and processes. A predictable path introduces two related vulnerabilities: - **Symlink/file-clobbering risk:** An attacker can pre-create `/tmp/research_time` as a symbolic link to another file writable by the victim. The shell redirection can then overwrite that target. - **Time-of-check/time-of-use code injection:** An attacker can replace or modify the temporary file after it is written but before it is sourced. Because `source` interprets the file as shell syntax, arbitrary commands can execute. The expected contents are only numeric assignments, so interpreting the file as executable shell code is unnecessary. ### Attack Path 1. A local attacker predicts the fixed path `/tmp/research_time`. 2. Before the Skill writes the file, the attacker creates a symbolic link at that path to a victim-writable target; alternatively, the attacker waits until the legitimate file is created. 3. The Skill writes timestamp data through shell redirection, potentially clobbering the symlink target. 4. Before a status check, the attacker replaces or modifies `/tmp/research_time` with content such as: ```bash START_TS=0 END_TS=0 malicious_command ``` 5. The Skil ...[truncated 826 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not persist these timestamps when they can remain in process variables. 2. Never use `source` to parse a data file. 3. If cross-command persistence is required, create a private file with `mktemp`: ```bash umask 077 RESEARCH_TIME_FILE=$(mktemp "${TMPDIR:-/tmp}/research_time.XXXXXX") || exit 1 trap 'rm -f "$RESEARCH_TIME_FILE"' EXIT ``` 4. Store plain numeric values rather than shell assignments. 5. Read values with non-executing parsing logic and validate them using a strict numeric expression such as `^[0-9]+$`. 6. Open files safely and reject symbolic links where supported. 7. Use an Agent-specific private runtime directory with restrictive permissions. 8. Clean up temporary state at the end of every run. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:77
• Finding: Mandatory Sub-Agent Delegation Transmits Exact User Queries to External Providers<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:36-39, 77-107` **Vulnerability Type**: Excessive disclosure of user data to delegated model providers **Risk Level**: Medium ### Vulnerable Code ```text **Sub-agent prompt injection surface:** The skill mandates pasting full instructions into sub-agent task prompts. This means the entire SKILL.md (including your research query) is sent to whatever model provider your sub-agent uses. If you use external/remote model providers, be aware that your research queries and the full skill text are transmitted to those services. ``` ```text ⛔ The sub-agent MUST have the full skill instructions in its task prompt. ``` ```text ## Research Task [The user's EXACT question, quoted verbatim. Do not paraphrase, soften, or broaden it.] ## Task Anchor (re-read every 5 tool calls) Your job is to answer THIS question: "[exact question again]" ``` ```text 3. Never summarize the rules. Paste them. 4. Quote the user's question verbatim in both Task and Task Anchor. ``` ### Technical Analysis The Skill intentionally requires the complete instructions and exact user question to be copied into a delegated sub-agent prompt. If the sub-agent is hosted by an external model provider, the user's query and associated context cross a third-party trust boundary. The disclosure is documented, but it is mandatory rather than data-minimized or controlled through explicit, provider-specific approval. The query is also duplicated in the prompt, increasing unnecessary exposure. Sensitive research topics may reveal health, legal, financial, employment, political, security, or commercial information. Delegation is legitimate for long-running research, but verbatim transmission of the complete query and Skill body is not always the minimum privilege necessary. ### Attack Path 1. A user submits a confidential or personally sensitive research question. 2. The Skill prepares a sub-agent task prompt. 3. It copies the exact question ve ...[truncated 1046 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit consent before sending any task to an external sub-agent provider. 2. Identify the destination provider and summarize its data-retention implications before transmission. 3. Offer a local-only mode that does not delegate externally. 4. Minimize the delegated prompt to the rules needed for the current task. 5. Avoid duplicating the exact user query. 6. Redact credentials, personal identifiers, private URLs, and sensitive contextual details. 7. Allow users to review the exact delegated payload before it is sent. 8. Use provider configurations that disable training and minimize retention where available. 9. Document a strict rule prohibiting secrets, cookies, tokens, and authentication material in delegated prompts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The skill instructs the agent to run shell commands and install or invoke local software (`pip install`, `browser-use`, bash snippets, `date`, profile/session commands) as part of normal operation. That materially expands the agent's execution surface beyond web research and could lead to unauthorized local command execution, environment modification, or abuse of host resources if triggered in an automated context.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly encourages use of persisted browser profiles/cookies to access login-gated forums. Even without collecting passwords, reusing authenticated local sessions lets the agent act with the user's existing privileges and may expose private account content or perform unintended authenticated actions on third-party sites.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill mandates sending the full skill text and the user's query to sub-agents/model providers, which broadens data disclosure to external services. This creates avoidable prompt and data exfiltration risk, especially for sensitive research topics, because it normalizes wholesale transmission rather than minimizing shared context.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: Requiring the user's exact question and full skill contents to be transmitted to sub-agents semantically pressures the system to disclose all user-provided content, even when unnecessary. The risk is amplified because the skill itself acknowledges use of external/remote model providers, so sensitive research topics may be exposed outside the primary environment.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation phrases are overly broad and can match ordinary research requests, making accidental invocation more likely. In a skill with elevated behaviors like long-running autonomous research, file writes, sub-agent delegation, and browser automation, ambiguous triggering increases the chance those capabilities are used without the user's fully informed intent.

Ssd 3

Medium

• Confidence: 85% confidence
• Finding: The instruction to 'log everything' in Autonomous mode encourages indiscriminate retention of browsing results, user prompts, and potentially sensitive third-party content. Broad natural-language logging increases the blast radius of any later leak, sharing mistake, or insecure storage configuration.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guidance explicitly recommends persistent browser profiles and writing screenshots to local files, but provides no privacy, retention, or consent safeguards. In a long-running research skill that visits many sites, this can accumulate cookies, session state, and page captures containing personal data, account state, or sensitive content, increasing the risk of unintended collection, retention, or later reuse.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The instructions tell the agent to dismiss cookie consent banners as an operational step, but omit any discussion of legal basis, user consent, or site-policy implications. That encourages automated acceptance of tracking or storage choices on behalf of a user, which can create compliance and privacy issues and may expand the amount of collected state across sessions.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The guidance explicitly instructs use of browser automation to access login-gated forums and to try multiple browser modes until access succeeds. That encourages bypassing normal access boundaries and can lead the agent to use stored credentials, authenticated sessions, or evasive techniques on third-party services without clear authorization, which is outside a normal read-only research scope.

Intent-Code Divergence

Low

• Confidence: 85% confidence
• Finding: The guide states that web_search's purpose is "Finding URLs to read. That's it" and says to ignore synthesized text entirely. Later workflow steps instruct using web_search for edge cases, forum experiences, other-language exploration, and retailer identification, which are broader analytical uses than the strict 'URLs only' claim.