Security audit

Browser Automation

Security checks across malware telemetry and agentic risk

Overview

This is a broad browser automation skill that is disclosed but needs review because it can act on real accounts and confirms browser dialogs by default.

Install only if you intend to let an agent operate real websites through a browser. Use a separate browser profile where possible, and require explicit confirmation before submitting forms, posting publicly, sending email, registering accounts, uploading files, accepting dialogs, inspecting network data, or clearing cookies/cache.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Scope Creep

Medium

Confidence: 92% confidence
Finding: The manifest advertises actions such as sending emails, posting to social media, and registering accounts, but only declares browser access and file read permissions. This mismatch can hide the true operational scope of the skill from reviewers and users, increasing the risk of unintended write-side actions being executed through browser automation without explicit consent boundaries.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger conditions are extremely broad and cover almost any request involving websites, forms, email, social media, or public information lookup. This can cause the skill to activate for routine tasks without sufficient user intent verification, increasing the chance of unintended navigation, data entry, or account-affecting actions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Allowing access to network requests and console logs without warning about secrets is risky because these artifacts often contain tokens, session identifiers, API responses, personal data, and internal error details. A user or agent could expose or mishandle sensitive information during debugging or data extraction tasks.

Missing User Warnings

High

Confidence: 97% confidence
Finding: Defaulting browser dialog handling to 'confirm' is dangerous because dialogs frequently guard destructive or high-risk actions such as form submission, file replacement, navigation away from unsaved work, permission grants, or security warnings. In a browser automation skill, this can directly cause unintended account changes, data loss, or acceptance of risky prompts without explicit user approval.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list contains very broad phrases like 'use browser', 'open webpage', and 'access website', which can cause the skill to activate for a wide range of ordinary browsing requests. In a browser automation skill with capabilities including form filling and posting, overbroad invocation increases the chance of the skill being selected in contexts where users did not intend powerful automation to run.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.