This report is not translated for the requested language. The canonical English report is shown instead.

Versioned security assessment

Report ID: SA-18E3D5D0

7/4/2026, 3:09:46 PM

firefox-browser security assessment v6

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
firefox-browser
Version
v6
Maintainer
1jehuang
Source
github.com/1jehuang/firefox-agent-bridge/tree/main/skill/
Coverage
1 Files scanned · 423 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

5 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most Ruby backtick findings are false positives caused by Markdown formatting, and the hardcoded URLs are examples. Real risks remain because the skill invokes a local browser CLI, starts Firefox in the background, and captures screenshots. It controls an authenticated Firefox profile, can use Bitwarden credentials, can execute arbitrary page JavaScript, and shows no prompt injection evidence.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 423 Lines analyzed

29 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 9 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 88 evidence locations

Capability review items (24)
High
SKILL.md:263-273
Ruby/shell backtick execution
```bash
The example combines browser navigation with autoLogin and optional submit. This external command path can fill credentials into a real site.
High
SKILL.md:277-285
Ruby/shell backtick execution
```bash
The vault examples invoke browser vaultStatus and vaultSync from Bash. They interact with credential vault state and server synchronization.
High
SKILL.md:305-321
Ruby/shell backtick execution
```bash
The evaluate examples invoke the browser CLI to execute arbitrary JavaScript and read form values. This can expose data from authenticated pages.
High
SKILL.md:327-336
Ruby/shell backtick execution
```bash
The pageWorld examples invoke browser evaluate with access to page-level globals. This expands the risk of reading or modifying sensitive page state.
Medium
SKILL.md:13-28
Ruby/shell backtick execution
```bash
The Quick Start tells the agent to run shell commands, including starting Firefox and invoking the local browser CLI. That is real external command use against the user's live browser.
Medium
SKILL.md:32-34
Ruby/shell backtick execution
```bash
The client usage section instructs use of the local browser CLI from Bash. The command surface is intentional and can drive browser actions.
Medium
SKILL.md:93-106
Ruby/shell backtick execution
```bash
The example invokes browser type and fillForm commands through Bash. These external commands can alter page content in the live browser.
Medium
SKILL.md:115-117
Ruby/shell backtick execution
```bash
The example instructs the agent to run browser listTabs from Bash. Listing real tabs can expose user browsing state.
Medium
SKILL.md:138-144
Ruby/shell backtick execution
```bash
The example invokes browser newSession and setActiveTab through Bash. These commands control real Firefox tabs.
Medium
SKILL.md:148-150
Ruby/shell backtick execution
```bash
The example invokes browser getContent through Bash. Page extraction from a live browser can expose user-visible content.
Medium
SKILL.md:165-174
Ruby/shell backtick execution
```bash
The example invokes browser click and type through Bash. These commands can modify pages or submit user-visible inputs.
Medium
SKILL.md:182-196
Ruby/shell backtick execution
```bash
The fork example runs browser commands that duplicate tabs and execute click actions. This is real external browser automation.
Medium
SKILL.md:211-214
Ruby/shell backtick execution
```bash
The example runs browser getContent and click against a named fork. It still invokes the local browser CLI to interact with real pages.
Medium
SKILL.md:217-219
Ruby/shell backtick execution
```bash
The example runs browser killFork through Bash. It is a documented external command that changes browser tab state.
Medium
SKILL.md:227-236
Ruby/shell backtick execution
```bash
The tryUntil example executes browser click alternatives from Bash. It can interact with live page controls without additional review.
Medium
SKILL.md:246-253
Ruby/shell backtick execution
```bash
The parallel example invokes the browser CLI to open multiple URLs and extract content. It creates real network and browser activity.
Medium
SKILL.md:294-297
Ruby/shell backtick execution
```bash
The example runs browser getAuthContext through Bash. It can inspect login-page context and available accounts.
Medium
SKILL.md:346-365
Ruby/shell backtick execution
```bash
The scroll examples invoke browser scroll through Bash. This is lower-risk but still confirms use of an external browser-control command.
Medium
SKILL.md:373-375
Ruby/shell backtick execution
```bash
The example invokes browser getContent through Bash to extract annotated page content. It can reveal form state from the live page.
Medium
SKILL.md:394-404
Ruby/shell backtick execution
```bash
The isolated-session example invokes multiple browser CLI commands against a tab ID. These commands navigate, extract content, click, and type in Firefox.
Medium
SKILL.md:419-420
Ruby/shell backtick execution
1. **Firefox not running?** Start it: `nohup firefox &>/dev/null &`
The troubleshooting step instructs starting Firefox with nohup from the shell. It creates a background browser process with output suppressed.
Medium
SKILL.md:420-421
Ruby/shell backtick execution
2. **Check connection**: `browser ping`
The troubleshooting step tells the agent to run browser ping from Bash. It is a real external CLI invocation, although low impact by itself.
Medium
SKILL.md:15
nohup (background persistent process)
nohup firefox &>/dev/null &
The skill explicitly instructs starting Firefox with nohup in the background and discarding output. This creates a persistent local process controlled outside the AI session.
Medium
SKILL.md:419
nohup (background persistent process)
1. **Firefox not running?** Start it: `nohup firefox &>/dev/null &`
The skill explicitly instructs starting Firefox with nohup in the background and discarding output. This creates a persistent local process controlled outside the AI session.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (5)

RISK-001 Critical
SKILL.md:257-290
Autonomous Credential Use Through Bitwarden
The authentication section describes Bitwarden-backed automatic credential filling, optional submission, vault synchronization, and auto-unlock from the system keyring. This creates a strong risk of credential misuse without explicit per-action user approval.
The text says no human interaction is needed, shows submit-capable autoLogin usage, and states the vault is auto-unlocked from the system keyring.
RISK-002 High
SKILL.md:54
Screen capture upload
| `screenshot` | Capture visible area as PNG | `filename` (optional) |
The skill documents a screenshot action that captures the visible browser area as a PNG. In a real authenticated Firefox profile, screenshots can expose private page content.
RISK-003 High
SKILL.md:3-4SKILL.md:7-9
Direct Control of Authenticated Firefox Session
The skill states that it controls the user's real Firefox browser with existing logins and cookies. This gives the agent access to authenticated web sessions rather than an isolated browser.
The front matter and introduction explicitly describe using the real browser with existing logins and cookies, and the skill permits Bash, Read, and Write tools.
RISK-004 High
SKILL.md:301-338
Arbitrary JavaScript Execution in Live Pages
The evaluate action runs arbitrary JavaScript and can use page-world access with full DOM access. On authenticated pages, this can read form values, inspect application state, or modify page behavior.
The section explicitly documents arbitrary scripts, form value reads, page-world execution, and full DOM access.
RISK-005 High
SKILL.md:51-54SKILL.md:369-386
Private Page and Form Data Exposure
The skill can extract page content, list interactable elements, capture screenshots, and show form states including typed values. These capabilities can expose private account data from the active Firefox profile.
The action table and form-state section document page extraction, screenshots, and returned form values from live pages.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Autonomous credential filling and submission
    Remove automatic vault unlock and auto-submit, or require visible per-domain approval before filling or submitting credentials.
  2. FIX-002
    High
    Authenticated Firefox profile access
    Default to a separate browser profile or require explicit confirmation before reading tabs, private pages, screenshots, or authenticated content.
  3. FIX-003
    High
    Arbitrary JavaScript evaluation
    Disable evaluate and pageWorld access by default, or restrict them to user-approved scripts with secret redaction.
  4. FIX-004
    High
    Screenshot and page content capture
    Gate screenshots and page extraction behind explicit user consent and redact sensitive form values when possible.
  5. FIX-005
    Medium
    Background Firefox startup
    Avoid nohup startup in the skill instructions, or document how users can inspect and stop the background browser process.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable