Security audit

Browser Use 2.0.0 Local

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is mostly transparent, but it grants a broad command surface that can use logged-in browser profiles, run Python, sync data to cloud services, and expose local ports publicly.

Review this carefully before installing. Prefer a dedicated low-privilege browser profile, avoid using it with personal or sensitive logged-in accounts, do not export cookies unless necessary, do not run Python from untrusted instructions, and only start tunnels or cloud/profile sync when you explicitly intend to expose or transfer that data.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: # Export to JSON browser-use python "code" # Execute Python (variables persist across calls) browser-use python --file script.py # Run file browser-use python --vars # Show defined variables browser-use python --reset # Clear namespace ``` Additional authorized functionality can store cloud credentials, expose local services, and synchronize browser profiles: ```bash browser-use cloud login <api-key> # Save API key (or set BROWSER_USE_API_KEY) b ...[truncated 2965 chars]:4
Finding: Overbroad browser-use Permission Exposes Arbitrary Execution and Sensitive Browser Capabilities
Content: View full analysis
# Real Chrome with Default profile (existing logins/cookies) browser-use --profile "Profile 1" open # Real Chrome with named profile ``` It also includes cookie export and arbitrary persistent Python execution: ```bash browser-use cookies export # Export to JSON browser-use python "code" # Execute Python (variables persist across calls) browser-use python --file script.py # Run file browser-use python --vars # Show defined variables browser-use python --reset # Clear namespace ``` Additional authorized functionality can store cloud credentials, expose local services, and synchronize browser profiles: ```bash browser-use cloud login # Save API key (or set BROWSER_USE_API_KEY) browser-use tunnel # Start Cloudflare tunnel (idempotent) browser-use profile sync --all # Sync profiles to cloud ``` ### Technical Analysis The wildcard declaration at line 4 authorizes the entire `browser-use` CLI even though the Skill's primary purpose is ordinary browser navigation, page interaction, screenshots, and data extraction. This violates the principle of least privilege because the same authorization covers materially more sensitive operations: - Running arbitrary Python code in a persistent local process. - Opening browser profiles containing existing authenticated sessions and cookies. - Exporting cookies into local JSON files. - Synchronizing browser profiles to a cloud service. - Saving a cloud ...[truncated 2085 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Documenting arbitrary Python execution inside a browser automation skill introduces a general-purpose code execution surface unrelated to simple web interaction. An agent using this skill could read local files, manipulate the environment, or chain browser data with local execution, greatly increasing abuse potential beyond the stated purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Tunnel commands expose local ports to the public internet, which is a substantial expansion from browser automation into network publication. If used on development servers, admin panels, or internal tools, this can unintentionally leak sensitive services or create a remote attack path.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The tunnel documentation shows how to expose a local service publicly but omits any warning that this creates an internet-accessible endpoint. Users may unknowingly publish internal apps, development tools, or unauthenticated services, leading to data exposure or compromise.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest and description present this as a browser interaction skill, but the documented capabilities materially expand its scope to include remote cloud browser control and REST API passthrough. That mismatch can cause operators to authorize or invoke the skill without understanding that browsing data, credentials, or page contents may be sent to external infrastructure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Profile-based browsing is presented as a convenience feature without warning that it reuses existing browser cookies, saved sessions, and account logins. This can cause an agent to operate with more privilege than expected and access private data on behalf of the user.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is framed as page interaction and extraction, but it also supports using real Chrome profiles plus cookie import/export, enabling access to existing authenticated sessions. That materially changes the trust boundary because the skill can act with a user's stored credentials and session state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Cloud commands provision and control a remote browser and expose API operations, but the documentation does not warn that page content, interactions, session data, or related metadata may transit a third-party service. This omission undermines informed consent and increases the chance of sensitive browsing activity being sent off-host unexpectedly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Profile synchronization to cloud and binary update capabilities are outside the core browser automation purpose and create additional supply-chain and data-exfiltration risk. Syncing profiles may transfer cookies and browsing state, while update commands can modify local binaries in ways the skill description does not prepare users for.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.