Stealth Browser

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:08 PM UTC
• Version: 1.0.0

Overview

This skill openly provides stealth browser automation for bypassing bot protections and also has unsafe execution, network, and install behavior that needs review before use.

Install only if you have an explicitly authorized need for stealth browsing and can run it in a disposable, isolated environment with tight outbound network controls. Do not use it against sites where automated access or bot-defense bypass is not authorized, and treat the current package as needing code fixes before normal use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:6

Finding

OS Command Injection Through Unescaped URL Arguments

Content

View full analysis

" `. 4. `execSync` passes the command string to a system shell. 5. The shell interprets the injected syntax and executes the attacker's command with the privileges and environment of the Skill process. For example, an argument shaped like `https://example.com; ` would terminate the intended browser command and introduce an ...[truncated 751 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: stealth-browser.js:48

Finding

Server-Side Request Forgery Through Unrestricted Browser Navigation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: stealth-browser.js:26

Finding

Chromium Security Sandbox Disabled While Processing Untrusted Websites

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: index.js:90

Finding

Automatic Third-Party Dependency Installation During Skill Loading

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (23)

Known Vulnerable Dependency: basic-ftp==5.1.0 — 4 advisory(ies): CVE-2026-27699 (Basic FTP has Path Traversal Vulnerability in its downloadToDir() method); GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more

Critical

• Category: Supply Chain
• Confidence: 90% confidence

Finding

basic-ftp 5.1.0 is flagged with multiple serious advisories including path traversal and command-injection style issues. Even as a transitive dependency, if any code path fetches or processes attacker-controlled FTP resources, exploitation could lead to arbitrary file writes, unexpected command execution on the FTP session, or denial of service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is framed around 'advanced anti-detection capabilities' and specifically claims to bypass Cloudflare bot detection, reCAPTCHA, and fingerprint-based blocking. In a general-purpose agent environment, promoting evasion of access controls materially increases abuse potential for unauthorized scraping, automated account actions, and circumvention of site protections.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly markets evasion of bot-detection controls and claims to bypass Cloudflare, reCAPTCHA, and similar protections, which are security and abuse-prevention mechanisms deployed by websites. In this context, the capability is more dangerous because the stated purpose is not ordinary browsing automation but concealment of automation and circumvention of access controls, enabling scraping, abuse, and unauthorized interaction with protected services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

runBrowser constructs a shell command with string interpolation: execSync(\node "${scriptPath}" ${args}`), where args` ultimately come from user input. This permits shell injection if an attacker supplies metacharacters in URLs or arguments, potentially leading to arbitrary command execution on the host running the skill.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

brace-expansion 1.1.12 has reported denial-of-service issues from pathological expansion patterns that can trigger extreme CPU or memory use. If attacker-controlled glob or pattern input reaches this library through transitive tooling, it can hang the process or exhaust resources.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

extract-zip 2.0.1 is associated with arbitrary file write and symlink traversal vulnerabilities during archive extraction. In browser automation stacks that may download and unpack browser artifacts, a malicious archive or compromised source could write outside the intended directory and overwrite sensitive files.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

ip-address 10.1.0 is flagged for parsing inconsistencies and XSS in HTML-emitting methods. In this lockfile it appears transitive and optional, so exploitability depends on whether the application uses those parsing or rendering paths with attacker-controlled input, but the version remains risky.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: minimatch==3.1.2 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

minimatch 3.1.2 has multiple ReDoS-style advisories where crafted patterns can cause catastrophic backtracking and CPU exhaustion. Because it is pulled in via glob/rimraf-style utilities, any feature that accepts attacker-controlled glob patterns can become a denial-of-service vector.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: tar-fs==3.0.4 — 3 advisory(ies): CVE-2025-48387 (tar-fs can extract outside the specified dir with a specific tarball); CVE-2024-12905 (tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted ); CVE-2025-59343 (tar-fs has a symlink validation bypass if destination directory is predictable w)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

tar-fs 3.0.4 has known path traversal and symlink/link-following extraction issues that can write outside the target directory. In a browser tooling ecosystem that may download and unpack archives, this can enable filesystem compromise if an attacker influences tarball contents or source.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.16.0 — 3 advisory(ies): CVE-2024-37890 (ws affected by a DoS when handling a request with many HTTP headers); CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

ws 8.16.0 is flagged for denial of service and possible memory disclosure issues. If the skill exposes or consumes WebSocket traffic in hostile environments, malformed frames or header-heavy requests could crash the process, exhaust memory, or leak process data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly advertises commands that open arbitrary URLs and save screenshots/PDFs, but it provides no warning about external network access, untrusted content handling, or filesystem writes. In an agent skill context, this omission increases the risk of unsafe use such as SSRF-style access, browsing attacker-controlled pages, or unintended file generation without operator awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill exposes commands that access arbitrary external websites and save fetched content as HTML, screenshots, or PDFs, but it does not warn users about outbound network access, local artifact creation, or the privacy/compliance implications of collecting remote content. In an agent context, this omission can mislead users into invoking a capability that stores potentially sensitive third-party data or triggers unintended access to external systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The browser command launches a subprocess and performs outbound access to user-specified URLs, but the skill provides no warning that using the command will start another process and contact external sites. In a security-sensitive agent environment, this matters because users may not realize their input can trigger network activity and expose internal-only URLs or credentials via SSRF-like usage.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill runs npm install automatically during onLoad, which executes arbitrary package lifecycle scripts and spawns shell commands outside the core browser function. Even if intended as convenience, this creates an unexpected code-execution path at load time and increases supply-chain risk because dependency installation can trigger network access and unreviewed script execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill performs dependency installation automatically when loaded, without a user-facing warning or consent flow. In practice this can trigger subprocess execution, network access, and package script execution in contexts where simply loading a skill is expected to be passive, making the behavior risky and surprising.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The direct dependency on playwright-extra together with puppeteer-extra-plugin-stealth indicates intentional anti-detection browser automation. In a skill context, that meaningfully increases abuse potential because it is designed to mask automation from websites and defenses, even if the lockfile alone does not prove malicious use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly enables stealth/anti-detection behavior via puppeteer-extra-plugin-stealth, which is designed to conceal browser automation from target websites. In a generic browsing utility with no documented, legitimate need for evasion, this increases the risk of covert scraping, bypass of bot-detection controls, and misuse against sites that rely on automation signals for abuse prevention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The tool accepts arbitrary URLs, fetches them headlessly, and returns page content or metadata, including in parallel, with no warning, allowlist, or user-facing disclosure of network access. In an agent-skill context, this can be used to silently contact attacker-controlled endpoints, scrape internal or sensitive web resources reachable from the host, and exfiltrate retrieved content via stdout.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The launch arguments disable or suppress common automation indicators, including --disable-blink-features=AutomationControlled, while also running with sandbox protections disabled. This combination materially increases abuse potential by making automated access harder to detect and reducing browser isolation, without any stated business or safety justification in the skill context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The screenshot and PDF modes write artifacts to /tmp without disclosing this behavior in usage text or prompting the caller. While less severe than stealth network access, undisclosed file creation can leak sensitive rendered content to shared temporary storage, create forensic blind spots for users, and surprise downstream systems that assume read-only behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency uses a caret range, which allows newer minor/patch releases to be installed without explicit review. In a security-sensitive skill centered on stealth browsing and bypassing bot protections, this increases supply-chain risk because compromised or breaking upstream updates could silently alter behavior or introduce malicious code.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json

"author": "Ezer",
  "license": "MIT",
  "dependencies": {
    "playwright-extra": "^4.3.6",
    "puppeteer-extra-plugin-stealth": "^2.11.2",
    "playwright-core": "^1.40.0"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The stealth plugin is unpinned and is directly related to anti-detection behavior, making unreviewed upstream updates especially risky. A malicious or compromised release could change fingerprinting evasion logic, add hidden network behavior, or otherwise expand the attack surface in a package already intended to bypass protections.

Content

Scanner excerpt · package.json (reported line 19)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "playwright-extra": "^4.3.6",
    "puppeteer-extra-plugin-stealth": "^2.11.2",
    "playwright-core": "^1.40.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

Using an unpinned version of playwright-core permits automatic adoption of newer compatible releases, which can introduce vulnerable or malicious code paths through the dependency chain. Because this skill is explicitly designed for stealth browser automation against bot protection, dependency trust should be tighter than in ordinary applications.

Content

Scanner excerpt · package.json (reported line 20)May include surrounding context.

json

"dependencies": {
    "playwright-extra": "^4.3.6",
    "puppeteer-extra-plugin-stealth": "^2.11.2",
    "playwright-core": "^1.40.0"
  }
}

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:9