ClawHub
Back to skill

Security audit

browser-cli

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is mostly coherent, but it asks users to run unverified remote installer code and use sensitive browser profile, cookie, cloud, and tunneling features without enough safety boundaries.

Install only if you trust the browser-use publisher and are comfortable granting a browser automation tool access to pages, cookies, profiles, local services, and cloud browsers. Prefer an isolated Python environment and a dedicated low-privilege browser profile; avoid syncing personal or work profiles, avoid public tunnels for sensitive local apps, redact diagnostic output before sharing, and close daemons, tunnels, and cloud browsers when done.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:18
Finding

Recommended Installer Executes a Mutable Remote Script Without Verification

Content
View full analysis
Remediation
View remediation
browser-use-install.sh" | sha256sum --check ``` 5. Cryptographically sign release artifacts and document signature verification against a pinned publisher key. 6. Instruct users to inspect the downloaded script and execute it only after verification: ```bash less browser-use-install.sh bash browser-use-install.sh ``` 7. Pin the installer and resulting package to an audited release. 8. Explicitly instruct users not to run the installer as root or administrator unless a documented operation strictly requires elevation. 9. Document every file, executable, browser component, network request, and configuration entry created by installation. 10. Provide rollback and uninstall procedures so users can remove all installed components safely. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:26
Finding

Manual Installation Resolves an Unpinned Third-Party Package

Content
View full analysis
Remediation
View remediation
" ``` 2. Generate and commit a lockfile containing exact versions for the package and all transitive dependencies. 3. Require cryptographic hashes for resolved artifacts, for example through a hash-locked requirements file: ```bash uv pip install --require-hashes -r requirements.lock ``` 4. Verify the provenance and signatures of published releases where supported. 5. Pin and verify the Chromium revision downloaded by `browser-use install`, including its expected digest or vendor signature. 6. Perform installation inside a dedicated virtual environment rather than a system or shared Python environment. 7. Run installation and the CLI as a non-administrative user with only the filesystem and browser access required for the intended task. 8. Review dependency updates before changing the pinned version and regenerate hashes only after that review. 9. Document the expected package index and configure trusted index sources explicitly to reduce repository substitution risk. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (9)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The installation instructions tell users to fetch a remote script over the network and pipe it directly into bash, which executes unreviewed code immediately. If the distribution server, DNS, TLS termination, or hosting account is compromised, users could execute attacker-controlled code on their systems.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

One-line Install (Recommended)

bash
# macOS / Linux
curl -fsSL https://browser-use.com/cli/install.sh | bash

# Windows (PowerShell)
& "C:\Program Files\Git\bin\bash.exe" -c 'curl -fsSL https://browser-use.com/cli/install.sh | bash'

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The shell pipeline chains network retrieval directly into command execution using '| bash', removing any pause for review and making accidental or malicious remote code execution straightforward. In documentation, this is especially risky because users often copy such commands verbatim.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

One-line Install (Recommended)

bash
# macOS / Linux
curl -fsSL https://browser-use.com/cli/install.sh | bash

# Windows (PowerShell)
& "C:\Program Files\Git\bin\bash.exe" -c 'curl -fsSL https://browser-use.com/cli/install.sh | bash'

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The Windows example repeats the same unsafe pattern by invoking bash to execute a remotely fetched script directly. This preserves the same supply-chain and remote-code-execution risk while making copy-paste execution easy for users.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

curl -fsSL https://browser-use.com/cli/install.sh | bash

Windows (PowerShell)

& "C:\Program Files\Git\bin\bash.exe" -c 'curl -fsSL https://browser-use.com/cli/install.sh | bash'

text

### Manual Install

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The profile sync section instructs users to sync Chrome profiles to the cloud, which can include cookies and authenticated session material, without clearly warning that this may transfer credentials, session tokens, and browsing data to a third-party environment. In the context of a browser automation skill, this meaningfully raises account-takeover and privacy risks if misused or if the cloud environment is compromised.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

browser-use init --list # List all templates browser-use init --template basic # Generate specific template browser-use init --output my_script.py # Specify output filename browser-use init --force # Overwrite existing files

text

---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation states that the doctor command prints diagnostics and config, but does not warn that configuration output may contain sensitive values such as API keys, endpoints, profile details, or filesystem paths. Users may paste command output into chats, tickets, or logs, inadvertently disclosing secrets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly recommends exposing a localhost service through a public tunnel and then accessing it from a cloud browser, but it provides no warning that this can publish a development service to the internet. That can unintentionally expose admin panels, debug endpoints, test data, or services without authentication, especially in an automation-oriented skill where users may copy commands verbatim.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

browser-use init --list # List all templates browser-use init --template basic # Generate specific template browser-use init --output my_script.py # Specify output filename browser-use init --force # Overwrite existing files

text

---

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 421)May include surrounding context.

md
| Start + navigate | `browser-use open <url>` |
| See elements | `browser-use state` |
| Click element | `browser-use click <index>` |
| Fill input | `browser-use input <index> "text"` |
| Press key | `browser-use keys "Enter"` |
| Screenshot | `browser-use screenshot out.png` |
| Run JS | `browser-use eval "js here"` |