Habilidades browser-use Historial de auditorías
🌐

Historial de auditorías

browser-use - 2 auditorías

Versión de auditoría 2

Más reciente Riesgo bajo

Mar 19, 2026, 08:21 AM

Static analysis flagged 163 patterns in SKILL.md documentation file. All findings are false positives: backtick patterns are markdown code blocks documenting CLI usage, URLs are example/documentation links, and file paths reference user-controlled locations for legitimate browser profile and cookie management. The skill provides browser automation via the browser-use CLI with no malicious intent detected.

1
Archivos escaneados
547
Líneas analizadas
6
hallazgos
claude
Auditado por
Problemas de riesgo medio (1)
Cookie Export/Import Capability
The skill supports exporting cookies to files and importing them, which could expose session tokens if misused. This is legitimate browser profile syncing functionality but should be documented.
Problemas de riesgo bajo (2)
External Command Documentation
SKILL.md contains extensive documentation of browser-use CLI commands. All instances are markdown code blocks for documentation purposes, not actual code execution.
Hardcoded URLs in Documentation
Multiple example URLs present in SKILL.md including github.com, example.com. These are documentation links and example values, not hardcoded endpoints for data exfiltration.

Factores de riesgo

⚙️ Comandos externos (2)
🌐 Acceso a red (2)
📁 Acceso al sistema de archivos (2)

Versión de auditoría 1

Riesgo bajo

Jan 26, 2026, 07:53 AM

Static analysis flagged patterns in SKILL.md documentation as potential security risks. After evaluation, all findings are false positives: bash code blocks were misidentified as shell execution, example URLs were flagged as hardcoded network endpoints, and documented environment variables were misclassified as credential access. The skill is a legitimate browser automation CLI tool with no malicious code or behavior patterns.

1
Archivos escaneados
219
Líneas analizadas
7
hallazgos
claude
Auditado por
Problemas de riesgo medio (3)
Documentation Code Blocks Misidentified as Shell Execution
Static analyzer flagged 67 instances of 'Ruby/shell backtick execution' in SKILL.md markdown file. These are bash code block examples (```bash ... ```) used for documentation purposes, not actual backtick shell execution.
Example URLs in Documentation Misidentified as Hardcoded Network Endpoints
Static analyzer flagged 6 hardcoded URLs in SKILL.md. These are example URLs (https://example.com, https://gmail.com, etc.) used in documentation to demonstrate CLI usage.
Documented Environment Variables Misclassified as Credential Access
Static analyzer flagged environment variable references (BROWSER_USE_API_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY) as credential access. These are documented configuration options for the CLI tool.
Problemas de riesgo bajo (1)
Base64 Encoding Reference in Screenshot Output
Documentation mentions base64 output for screenshots. Base64 is encoding, not cryptographic encryption.

Factores de riesgo