المهارات multi-account-isolation
📦
multi-account-isolation
مراجعة المحتوى r1 مخاطر عالية ⚙️ الأوامر الخارجية🌐 الوصول إلى الشبكة📁 الوصول إلى نظام الملفات🔑 متغيرات البيئة
Verify Browser Profile Isolation
Multi-account browser setups can leak identity through shared storage, mismatched network signals, or unstable fingerprints. This skill provides repeatable checks for authorized profiles, QA fixtures, and anti-fraud testing.
يدعم: Claude Codex Code(CC)
توقف واطلب التأكيد قبل التثبيت.
راجع الخطة واحصل على موافقة صريحة من المستخدم قبل تغيير الملفات.
التثبيت باستخدام Agent لدي
انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.
طلب الوكيل
Review the Skillstore skill "multi-account-isolation" from https://skillstore.io/skills/antibrow-multi-account-isolation.md and its manifest at https://skillstore.io/api/skills/antibrow-multi-account-isolation/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.
موارد مهيّأة لـ Agents
استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.
اختبرها
جارٍ استخدام "multi-account-isolation". Three profiles use distinct names, but profiles two and three report the same public IP.
النتيجة المتوقعة:
Finding: the network exit is not unique. Check proxy assignment and confirm the observed address from inside each profile before investigating fingerprint settings.
جارٍ استخدام "multi-account-isolation". A profile has matching timezone and IP signals, but its canvas hash changes after relaunch.
النتيجة المتوقعة:
Finding: the persona is not stable. Verify that the same profile directory and cache are used, then repeat the test across multiple launches.
جارٍ استخدام "multi-account-isolation". A runtime stores login state locally and sends a license request during startup.
النتيجة المتوقعة:
- Local risk: protect profile directories because they contain session artifacts.
- Network risk: monitor the license request and restrict outbound access to approved services.
- Control: pin the runtime version and verify its published integrity hash.
التدقيق الأمني
مخاطر عاليةv1 • ٧/٨/٢٠٢٦ فتح التقرير المرتبط بالإصدار
The static catalog primarily flags documentation examples, code fences, reference URLs, and ordinary environment configuration as dangerous patterns. Credential, proxy, profile-storage, and license-key handling are genuine security-sensitive behaviors, but the skill states authorized-use limits and recommends auditing runtime behavior. No prompt injection or direct credential-exfiltration instruction was found in SKILL.md.
1
الملفات التي تم فحصها
144
الأسطر التي تم تحليلها
18
عناصر المراجعة
0
تم تجاهل الإيجابيات الكاذبة
مخاوف أمنية مؤكدة (5)
مرتفع
Environment file access
const ab = new AntiDetectBrowser({ key: process.env.ANTI_DETECT_BROWSER_KEY })
The example passes an environment-sourced API key into the browser SDK. This is a real sensitive-credential handling point, even without evidence of malicious use.
مرتفع
Environment file access
{ profile: 'fixture-us-01', proxy: process.env.PROXY_US_1, tags: ['Windows 10', 'Chrome'] },
The example passes an environment-sourced proxy URL into the SDK. Proxy URLs can contain authentication material and require controlled handling.
مرتفع
Environment file access
{ profile: 'fixture-us-02', proxy: process.env.PROXY_US_2, tags: ['Apple Mac', 'Safari'] },
The example passes a second environment-sourced proxy URL into the SDK. Proxy URLs can contain authentication material and require controlled handling.
مرتفع
Environment file access
{ profile: 'fixture-de-01', proxy: process.env.PROXY_DE_1, tags: ['Windows 10', 'Edge'] },
The example passes a third environment-sourced proxy URL into the SDK. Proxy URLs can contain authentication material and require controlled handling.
مرتفع
Certificate/key files
| API key | your environment, or `~/.antibrow/license.key` | Exchanged with `antibrow.com` for a sho
The documentation identifies a local license-key file as an API credential source. A compromised or mishandled key can authorize vendor access.
عناصر مراجعة القدرات (18)
هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.
مرتفع
SOCKS proxy
| Proxy URL and its credentials | passed to the kernel at launch; answered in the network stack (HTT
The skill handles proxy URLs and credentials and states that they reach the kernel and proxy provider. This creates a genuine third-party credential and traffic-trust boundary.
مرتفع
Hidden file in home directory
| 8 | Cookie jars are separate | Inspect `~/.anti-detect-browser/<profile>/` | One profile directory
The documented hidden profile directory contains cookie jars and identity state. Unauthorized local access could expose logged-in sessions or cross-account data.
مرتفع
Hidden file in home directory
1. **Profile name reused?** `list_profiles`, or look at `~/.anti-detect-browser/`. Two identities in
The skill directs operators to inspect a hidden profile directory that can contain multiple identities. That state is security-sensitive even though the inspection is authorized troubleshooting.
مرتفع
Hidden file in home directory
| Cookies, `localStorage`, login state | `~/.anti-detect-browser/<profile>/` on your disk | Local. C
The skill explicitly places cookies, localStorage, and login state in a hidden home-directory path. Those artifacts can grant access to logged-in accounts if exposed.
مرتفع
Hidden file in home directory
| API key | your environment, or `~/.antibrow/license.key` | Exchanged with `antibrow.com` for a sho
The documented hidden path stores an API license key. Exposure of that key can enable unauthorized use or incur vendor account impact.
متوسط
Hidden file access
| 8 | Cookie jars are separate | Inspect `~/.anti-detect-browser/<profile>/` | One profile directory
The skill recommends inspecting local profile storage that contains cookies and login state. This is legitimate for owned profiles but remains sensitive filesystem access.
متوسط
Hidden file access
1. **Profile name reused?** `list_profiles`, or look at `~/.anti-detect-browser/`. Two identities in
The troubleshooting procedure accesses hidden profile data to detect reuse. The purpose is authorized, but the data can expose identity and session information.
متوسط
Hidden file access
| Cookies, `localStorage`, login state | `~/.anti-detect-browser/<profile>/` on your disk | Local. C
The line identifies cookies, localStorage, and login state in local hidden storage. Reading or copying those artifacts carries a direct session-disclosure risk.
متوسط
Hidden file access
| API key | your environment, or `~/.antibrow/license.key` | Exchanged with `antibrow.com` for a sho
The line identifies a hidden license-key file as a credential source. Access is expected for the runtime, but mishandling can disclose the key.
منخفض
Environment variable access (dot notation)
const ab = new AntiDetectBrowser({ key: process.env.ANTI_DETECT_BROWSER_KEY })
The example reads an API key from the environment. This is a normal secret-injection pattern, but the value is security-sensitive and must be protected from logs and unintended processes.
منخفض
Environment variable access (dot notation)
{ profile: 'fixture-us-01', proxy: process.env.PROXY_US_1, tags: ['Windows 10', 'Chrome'] },
The example reads a proxy setting from the environment. Proxy URLs may contain credentials and should be treated as secrets.
منخفض
Environment variable access (dot notation)
{ profile: 'fixture-us-02', proxy: process.env.PROXY_US_2, tags: ['Apple Mac', 'Safari'] },
The example reads a second proxy setting from the environment. Proxy URLs may contain credentials and should be treated as secrets.
منخفض
Environment variable access (dot notation)
{ profile: 'fixture-de-01', proxy: process.env.PROXY_DE_1, tags: ['Windows 10', 'Edge'] },
The example reads a third proxy setting from the environment. Proxy URLs may contain credentials and should be treated as secrets.
منخفض
Environment variable object
const ab = new AntiDetectBrowser({ key: process.env.ANTI_DETECT_BROWSER_KEY })
The environment object supplies an API key to the SDK. This is expected configuration, but it creates a secret-handling boundary.
منخفض
Environment variable object
{ profile: 'fixture-us-01', proxy: process.env.PROXY_US_1, tags: ['Windows 10', 'Chrome'] },
The environment object supplies a proxy value to the SDK. That value may embed credentials and requires secret-handling controls.
منخفض
Environment variable object
{ profile: 'fixture-us-02', proxy: process.env.PROXY_US_2, tags: ['Apple Mac', 'Safari'] },
The environment object supplies a second proxy value to the SDK. That value may embed credentials and requires secret-handling controls.
منخفض
Environment variable object
{ profile: 'fixture-de-01', proxy: process.env.PROXY_DE_1, tags: ['Windows 10', 'Edge'] },
The environment object supplies a third proxy value to the SDK. That value may embed credentials and requires secret-handling controls.
منخفض
Python environment access
proxy=os.environ["PROXY_US_1"], # from the environment, never a literal
The Python example reads a proxy value from the process environment. The pattern is legitimate, but the value may contain credentials.
عوامل الخطر
⚙️ الأوامر الخارجية (26)
SKILL.md:21-24 SKILL.md:24-26 SKILL.md:26-30 SKILL.md:30-51 SKILL.md:51-55 SKILL.md:55-67 SKILL.md:67-75 SKILL.md:75 SKILL.md:78 SKILL.md:79-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-84 SKILL.md:84-92 SKILL.md:92 SKILL.md:93-94 SKILL.md:94 SKILL.md:95-104 SKILL.md:104 SKILL.md:105-107 SKILL.md:107 SKILL.md:111-113 SKILL.md:113-115 SKILL.md:115-117 SKILL.md:117-119 SKILL.md:119-138
🌐 الوصول إلى الشبكة (6)
📁 الوصول إلى نظام الملفات (8)
🔑 متغيرات البيئة (9)
دقّقه: codex
شارك واستشهد بهذا التقرير
شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.
نسخ رابط التقرير
https://skillstore.io/skills/antibrow-multi-account-isolation/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportشارة Markdown
[](https://skillstore.io/skills/antibrow-multi-account-isolation?utm_source=security_passport_badge)شارة HTML
<a href="https://skillstore.io/skills/antibrow-multi-account-isolation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/antibrow-multi-account-isolation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>بطاقة قابلة للتضمين
<iframe src="https://skillstore.io/embed/skills/antibrow-multi-account-isolation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>الاستشهادات الأكاديمية (APA · BibTeX · CFF)
اقتباس APA
antibrow. (2026). multi-account-isolation security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/antibrow-multi-account-isolation/audits/1اقتباس BibTeX
@techreport{antibrow-antibrow-multi-account-isolation-2026,
author = {antibrow},
title = {multi-account-isolation security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/antibrow-multi-account-isolation/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "multi-account-isolation security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "antibrow"
date-released: "2026-08-07"
url: "https://skillstore.io/skills/antibrow-multi-account-isolation/audits/1"
identifiers:
- type: other
value: "skillstore:antibrow-multi-account-isolation:audit:1"
description: "Skillstore immutable audit report identifier"
تقييم Skillstore
سبب هذا التقييم موثوقية الأدلة: متوسط 55
الهندسة المعمارية
85
قابلية الصيانة
87
المحتوى
65
المجتمع
91
الامتثال للمواصفات
ما الذي يمكنك بناؤه
Audit a QA fleet
Verify that test identities have separate storage, network exits, timezones, and stable fingerprints before automated test runs.
Review a browser vendor
Map where cookies, personas, proxy credentials, API keys, and license traffic go during a controlled runtime audit.
Diagnose account association
Trace isolation failures from reused profile names and shared addresses to timezone, fingerprint, or storage inconsistencies.
جرّب هذه الموجّهات
Basic isolation checklist
Create a simple checklist to verify that three authorized browser profiles use separate personas, proxies, timezones, public IPs, and cookie jars.
Investigate a mismatch
Analyze these profile test results and identify the cheapest troubleshooting order for a timezone mismatch, repeated public IP, or unstable canvas hash: [paste results].
Design repeatable checks
Design a CI test plan for authorized profiles covering timezone and IP agreement, canvas stability across relaunches, public IP uniqueness, and cross-layer browser consistency.
Perform a runtime audit
Prepare a controlled security audit for this browser runtime. Track where cookies, login state, personas, API keys, proxy credentials, and license traffic are stored or transmitted, and list evidence to collect: [runtime details].
أفضل الممارسات
- Use only accounts, test fixtures, and systems that you own or are authorized to operate.
- Run cheap, deterministic checks in CI and retain evidence for each profile and launch.
- Protect profile storage and credentials with least privilege, redaction, encryption, and retention controls.
تجنب
- Do not reuse one profile by logging out and switching between identities.
- Do not treat a clean browser fingerprint as proof that accounts are unrelated.
- Do not test third-party accounts, bypass platform enforcement, or expose credentials to untrusted tools.
الأسئلة المتكررة
What does this skill verify?
It verifies separation and consistency across browser profiles, network exits, timezones, fingerprints, storage, and related runtime signals.
Does it create or configure profiles?
No. It audits an existing anti-detect-browser setup and points to the related SDK skill for profile creation and launch.
Can it guarantee account separation?
No. Shared payment details, contact data, activity patterns, identity checks, and platform decisions remain outside the browser layer.
Which checks belong in CI?
Start with timezone and IP agreement, canvas stability across relaunches, and unique public IPs because they are cheap and repeatable.
How should credentials be handled?
Use scoped secrets, protect local profile files, redact logs, monitor outbound traffic, and confirm which vendor services receive credentials.
Is this suitable for account evasion?
No. Use it only for authorized accounts, client work with permission, QA fixtures, anti-fraud testing, and runtime security audits.