browser-cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:24 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is mostly coherent, but it asks users to run unverified remote installer code and use sensitive browser profile, cookie, cloud, and tunneling features without enough safety boundaries.

Install only if you trust the browser-use publisher and are comfortable granting a browser automation tool access to pages, cookies, profiles, local services, and cloud browsers. Prefer an isolated Python environment and a dedicated low-privilege browser profile; avoid syncing personal or work profiles, avoid public tunnels for sensitive local apps, redact diagnostic output before sharing, and close daemons, tunnels, and cloud browsers when done.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:18
• Finding: Recommended Installer Executes a Mutable Remote Script Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18–23 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ### Vulnerable Code ```bash ### One-line Install (Recommended) ```bash # macOS / Linux curl -fsSL https://browser-use.com/cli/install.sh | bash # Windows (PowerShell) & "C:\Program Files\Git\bin\bash.exe" -c 'curl -fsSL https://browser-use.com/cli/install.sh | bash' ``` ### Technical Analysis The recommended installation method downloads content from `https://browser-use.com/cli/install.sh` and pipes it directly into Bash. The downloaded response is neither displayed for review nor checked against a pinned version, cryptographic digest, or trusted signature before execution. Consequently, the code that executes is determined at installation time rather than audit time. The effective payload can change without any modification to this skill package. HTTPS protects the connection in transit under normal conditions, but it does not protect users if the hosting account, web server, domain, release process, or another component in the upstream trust chain is compromised. The Windows instruction reproduces the same behavior by invoking Git Bash from PowerShell. This does not mitigate the underlying risk. Installation is necessary for the skill's declared browser-automation functionality, but immediate execution of an unverified remote response is not the minimum necessary installation mechanism. The document already presents a package-manager-based alternative, although that alternative also requires dependency pinning improvements. ### Attack Path 1. An attacker compromises the installer hosting infrastructure, deployment credentials, domain, or another component capable of changing the response returned from the installer URL. 2. The attacker modifies `install.sh` to contain malicious shell commands. 3. A user or agent follows the explicitly recommended one-line installation instru ...[truncated 1185 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `curl | bash` from the recommended installation workflow. 2. Publish immutable, versioned installer artifacts rather than relying on a mutable URL. 3. Download the selected installer to a local file before execution: ```bash curl -fL -o browser-use-install.sh \ https://example.invalid/releases/vX.Y.Z/browser-use-install.sh ``` 4. Publish the expected SHA-256 digest through a separately controlled release channel and verify it before execution: ```bash echo "<EXPECTED_SHA256> browser-use-install.sh" | sha256sum --check ``` 5. Cryptographically sign release artifacts and document signature verification against a pinned publisher key. 6. Instruct users to inspect the downloaded script and execute it only after verification: ```bash less browser-use-install.sh bash browser-use-install.sh ``` 7. Pin the installer and resulting package to an audited release. 8. Explicitly instruct users not to run the installer as root or administrator unless a documented operation strictly requires elevation. 9. Document every file, executable, browser component, network request, and configuration entry created by installation. 10. Provide rollback and uninstall procedures so users can remove all installed components safely. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26
• Finding: Manual Installation Resolves an Unpinned Third-Party Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 26–30 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash ### Manual Install ```bash uv pip install browser-use browser-use install # downloads Chromium browser-use doctor # validates setup ``` ### Technical Analysis The manual installation command identifies `browser-use` only by package name. It does not constrain the package to an audited version, require artifact hashes, or use a committed lockfile. The package index may therefore resolve whichever release is considered current at installation time. The installed code can change independently of this reviewed skill document, producing non-reproducible installations and increasing exposure to a compromised publisher account, malicious upstream release, or other supply-chain failure. The subsequent `browser-use install` command also downloads Chromium according to the installed package's implementation. Because the package version is uncontrolled, the logic selecting and validating that additional component is uncontrolled as well. This finding does not establish that the named package or its current releases are malicious. It identifies the lack of controls ensuring that users receive the same reviewed dependency and artifacts. ### Attack Path 1. An attacker compromises the upstream package publisher, release process, package repository, or a relevant distribution account. 2. The attacker publishes a malicious or altered release under the legitimate package name. 3. A user follows the documented manual installation command without specifying a version or hash. 4. The package resolver selects the compromised release. 5. Package-controlled code becomes available in the user's Python environment and is subsequently executed through commands such as `browser-use install` or normal CLI use. 6. The compromised CLI can download further components or access resource ...[truncated 817 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `browser-use` to a specific audited version: ```bash uv pip install "browser-use==<AUDITED_VERSION>" ``` 2. Generate and commit a lockfile containing exact versions for the package and all transitive dependencies. 3. Require cryptographic hashes for resolved artifacts, for example through a hash-locked requirements file: ```bash uv pip install --require-hashes -r requirements.lock ``` 4. Verify the provenance and signatures of published releases where supported. 5. Pin and verify the Chromium revision downloaded by `browser-use install`, including its expected digest or vendor signature. 6. Perform installation inside a dedicated virtual environment rather than a system or shared Python environment. 7. Run installation and the CLI as a non-administrative user with only the filesystem and browser access required for the intended task. 8. Review dependency updates before changing the pinned version and regenerate hashes only after that review. 9. Document the expected package index and configure trusted index sources explicitly to reduce repository substitution risk. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (9)

External Script Fetching

High

• Category: Supply Chain

Content

### One-line Install (Recommended)
```bash
# macOS / Linux
curl -fsSL https://browser-use.com/cli/install.sh | bash

# Windows (PowerShell)
& "C:\Program Files\Git\bin\bash.exe" -c 'curl -fsSL https://browser-use.com/cli/install.sh | bash'

• Confidence: 99% confidence
• Finding: The installation instructions tell users to fetch a remote script over the network and pipe it directly into bash, which executes unreviewed code immediately. If the distribution server, DNS, TLS termination, or hosting account is compromised, users could execute attacker-controlled code on their systems.

Chaining Abuse

High

• Category: Tool Misuse

Content

### One-line Install (Recommended)
```bash
# macOS / Linux
curl -fsSL https://browser-use.com/cli/install.sh | bash

# Windows (PowerShell)
& "C:\Program Files\Git\bin\bash.exe" -c 'curl -fsSL https://browser-use.com/cli/install.sh | bash'

• Confidence: 97% confidence
• Finding: The shell pipeline chains network retrieval directly into command execution using '| bash', removing any pause for review and making accidental or malicious remote code execution straightforward. In documentation, this is especially risky because users often copy such commands verbatim.

External Script Fetching

High

• Category: Supply Chain

Content

curl -fsSL https://browser-use.com/cli/install.sh | bash

# Windows (PowerShell)
& "C:\Program Files\Git\bin\bash.exe" -c 'curl -fsSL https://browser-use.com/cli/install.sh | bash'
```

### Manual Install

• Confidence: 99% confidence
• Finding: The Windows example repeats the same unsafe pattern by invoking bash to execute a remotely fetched script directly. This preserves the same supply-chain and remote-code-execution risk while making copy-paste execution easy for users.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The profile sync section instructs users to sync Chrome profiles to the cloud, which can include cookies and authenticated session material, without clearly warning that this may transfer credentials, session tokens, and browsing data to a third-party environment. In the context of a browser automation skill, this meaningfully raises account-takeover and privacy risks if misused or if the cloud environment is compromised.

Self-Modification

High

• Category: Rogue Agent

Content

browser-use init --list                   # List all templates
browser-use init --template basic         # Generate specific template
browser-use init --output my_script.py    # Specify output filename
browser-use init --force                  # Overwrite existing files
```

---

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation states that the doctor command prints diagnostics and config, but does not warn that configuration output may contain sensitive values such as API keys, endpoints, profile details, or filesystem paths. Users may paste command output into chats, tickets, or logs, inadvertently disclosing secrets.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly recommends exposing a localhost service through a public tunnel and then accessing it from a cloud browser, but it provides no warning that this can publish a development service to the internet. That can unintentionally expose admin panels, debug endpoints, test data, or services without authentication, especially in an automation-oriented skill where users may copy commands verbatim.

Session Persistence

Medium

• Category: Rogue Agent

Content

browser-use init --list                   # List all templates
browser-use init --template basic         # Generate specific template
browser-use init --output my_script.py    # Specify output filename
browser-use init --force                  # Overwrite existing files
```

---

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

| Start + navigate | `browser-use open <url>` |
| See elements | `browser-use state` |
| Click element | `browser-use click <index>` |
| Fill input | `browser-use input <index> "text"` |
| Press key | `browser-use keys "Enter"` |
| Screenshot | `browser-use screenshot out.png` |
| Run JS | `browser-use eval "js here"` |

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Static analysis

No suspicious patterns detected.