Security audit

Agentic Browser 0.1.2

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent browser automation skill, but it needs review because installation and several documented browser actions can expose credentials, files, cookies, or recordings without strong safeguards.

Install only if you trust inference.sh and are comfortable with a hosted browser service handling the pages, credentials, files, screenshots, videos, cookies, and proxy settings you send through it. Avoid the pipe-to-shell installer unless you can verify the installer independently, use test or least-privilege accounts, do not upload sensitive local files, avoid recording login or admin flows, and close sessions promptly.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:23
Finding: Unpinned Remote Installer Is Downloaded and Executed Directly
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/authentication.md:31
Finding: Authentication, MFA, and Proxy Secrets Are Exposed Through Command Arguments and a Remote Service
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:161
Finding: Arbitrary Local File Upload Is Available Without Path Restrictions or Per-Upload Consent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/authentication.md:209
Finding: Authenticated Session Cookies Are Printed in Plaintext
Content: View full analysis
r.name))" }') ``` ``` ### Technical Analysis The example extracts cookies available through `document.cookie` and prints them directly to standard output. Authentication cookies and other session values may consequently be retained in terminal scrollback, shell-session recordings, CI logs, Agent traces, or centralized log collectors. Cookies available to `document.cookie` are not necessarily harmless. A non-HttpOnly authentication or session cookie may be sufficient to impersonate the user until it expires or is revoked. The comment claiming that the subsequent resource-timing expression retrieves “all cookies including httpOnly” is inaccurate. `performance.getEntriesByType("resource")` returns resource timing entries and URLs; browser JavaScript cannot read HttpOnly cookie values through this mechanism. This misleading statement may cause users to misunderstand the security boundary. ### Attack Path 1. The browser session authenticates to a target service. 2. The user runs the documented cookie extraction sequence. 3. The script assigns the result of `document.cookie` to `COOKIES`. 4. `echo "Cookies: $COOKIES"` writes the complete value to standard output. 5. Terminal capture, CI output, an Agent transcript, or centralized logging stores the value. 6. ...[truncated 663 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: curl -fsSL https://cli.inference.sh | sh downloads and immediately executes a remote script without verification, which is a classic supply-chain and remote code execution risk. If the host, transport, DNS, or distribution pipeline is compromised, users following the quick-start can execute attacker-controlled shell code on their machine.
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
bash
# Install CLI curl -fsSL https://cli.inference.sh | sh && infsh login # Open a page and get interactive elements infsh app run agent-browser --function open --input '{"url": "https://example.com"}' --session new

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list is very broad and overlaps heavily with ordinary browsing, scraping, and research language, making it likely this powerful browser automation skill will be invoked in situations where a narrower tool would suffice. Because the skill supports clicking, file upload, proxying, and JavaScript execution, over-triggering increases the chance of unintended web actions, sensitive data exposure, or unsafe automation on untrusted sites.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation promotes screenshots and video recording but does not warn that these captures may include credentials, tokens, personal data, or other sensitive on-screen content. In an agentic browsing context, this is especially risky because recordings and screenshots may be stored, returned to callers, or shared for debugging, expanding the exposure surface of sensitive session data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The proxy example includes proxy URL and credentials without any warning that all browsing traffic, session data, and possibly authentication secrets may transit through a third-party proxy. In a browser automation skill, this materially increases interception and credential-exposure risk, especially if users apply the example to authenticated or sensitive workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file upload automation example lacks a warning that local files selected by the agent may be transmitted to remote websites, potentially exfiltrating sensitive local data. This is more dangerous in this skill because file upload is an active capability that can directly move local content across trust boundaries with minimal user visibility.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The cookie extraction section demonstrates retrieving and printing cookies from an authenticated browser session without a clear warning that these values are sensitive session artifacts and may enable session hijacking if copied, logged, or reused. In the context of a browser automation skill that explicitly supports authenticated browsing and JavaScript execution, normalizing cookie extraction increases the chance that users will expose live session data to logs, terminals, or downstream tools.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented interact actions include side-effectful operations such as click, fill, upload, check, drag, goto, and keypresses that can submit forms, change account settings, trigger purchases, upload local files, or navigate to untrusted destinations. In a browser automation skill intended for AI agents, omitting explicit safety guidance increases the chance that an agent will perform real-world actions on behalf of a user without confirmation or understanding of consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The execute function allows arbitrary JavaScript execution in the page context, which can alter page state, trigger network requests, exfiltrate visible or accessible page data, and perform actions indistinguishable from a user session. Because this skill is explicitly designed for autonomous browser control, documenting raw code execution without strong warnings or guardrails materially raises the risk of misuse and unsafe agent behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation encourages routing browser traffic through third-party proxies but does not warn that the proxy operator can observe destination metadata and potentially page contents, cookies, or credentials depending on the traffic and trust model. In a browser automation skill, this omission is more dangerous because the tool may handle sensitive sessions, authenticated workflows, and scraped data at scale, making users more likely to expose valuable information to untrusted proxy infrastructure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The authenticated proxy example shows direct handling of proxy usernames and passwords without a prominent warning about credential sensitivity, reuse risk, or secure secret storage. In this skill context, proxy credentials may grant access to corporate egress infrastructure or privacy services, and browser automation users may copy these examples into scripts, logs, shell history, or version control, causing credential leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The recording guidance explains that all browser activity is captured, but the examples around debugging and documentation do not prominently warn that typed inputs, page contents, and other sensitive on-screen data may be recorded and later stored, copied, or shared. In a browser automation skill that can fill forms and interact with authenticated applications, this omission can lead users to unintentionally capture credentials, personal data, or internal admin activity in persistent video artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This workflow is explicitly designed to collect broad page artifacts including screenshots, full text, links, and optional session video from arbitrary URLs, but it provides no consent warning, sensitivity checks, domain restrictions, or guidance to avoid authenticated/private content. In the context of a browser automation skill with JavaScript execution and recording capabilities, that omission increases the risk of unintentionally capturing credentials, personal data, internal documents, or other sensitive information from visited pages.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation exposes screenshot and video recording features without warning that captures may contain credentials, personal data, session details, or other sensitive on-screen information. In an agent browsing context, automated recording can silently retain or transmit sensitive content beyond what users expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The skill documentation shows filling a password field with plaintext example data, but it does not include any warning about credential sensitivity, privacy, or safe handling of secrets. For markdown files, SQP-2 applies when the description omits warnings about behaviors that could affect user data or privacy.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.