This report is not translated for the requested language. The canonical English report is shown instead.
Versioned security assessment
Report ID: SA-A0668140
7/6/2026, 3:34:15 PM
agent-browser security assessment v4
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- agent-browser
- Version
- v4
- Maintainer
- inference-sh-9
- Coverage
- 9 Files scanned · 2,107 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
6 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most static shell, URL, filesystem, and Markdown backtick findings are benign documentation or formatting artifacts. Confirmed risks include the pipe-to-shell installer, screen and video capture, SOCKS proxy routing, executable shell templates, cookie extraction, arbitrary page JavaScript, proxy rotation, and local file upload. No prompt injection attempt was found in the reviewed files.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
9 Files scanned · 2,107 Lines analyzed
37 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 55 evidence locations
Filesystem access
May read or write local files.
Observed in 15 evidence locations
Env variables
May read values from the process environment.
Not recorded by this audit
External commands
May invoke commands or programs outside the Skill.
Observed in 158 evidence locations
Capability review items (31)
High
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION --input '{
The cited authentication example extracts browser cookie data with page JavaScript and stores it in shell variables. That can expose active session material from authenticated pages.
High
Shell command substitution
COOKIES=$(echo $RESULT | jq -r '.result')
The cited authentication example extracts browser cookie data with page JavaScript and stores it in shell variables. That can expose active session material from authenticated pages.
High
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION --input '{
The cited authentication example extracts browser cookie data with page JavaScript and stores it in shell variables. That can expose active session material from authenticated pages.
High
Shell command substitution
PROXY_INDEX=$((i % ${#PROXIES[@]}))
This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.
High
Shell command substitution
echo "Fetching $URL via proxy $((PROXY_INDEX + 1))"
This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.
High
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.
High
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION --input '{
This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.
High
Unix shell invocation
#!/bin/bash
This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.
High
SOCKS proxy
"proxy_url": "socks5://privacy-proxy.example.com:1080"
The proxy documentation explicitly supports SOCKS5 proxy routing. This is a dual-use anonymity and traffic-routing feature that can bypass source attribution or access controls.
High
SOCKS proxy
### SOCKS5 Proxy
The proxy documentation explicitly supports SOCKS5 proxy routing. This is a dual-use anonymity and traffic-routing feature that can bypass source attribution or access controls.
High
SOCKS proxy
{"proxy_url": "socks5://proxy.example.com:1080"}
The proxy documentation explicitly supports SOCKS5 proxy routing. This is a dual-use anonymity and traffic-routing feature that can bypass source attribution or access controls.
High
Shell command substitution
TASK_ID=$(date +%Y%m%d-%H%M%S)
This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.
High
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.
High
Shell command substitution
RESULT=$(infsh app run agent-browser --function close --session $SESSION --input '{}')
This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.
High
Shell command substitution
VIDEO=$(echo $RESULT | jq -r '.video')
This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.
High
Unix shell invocation
#!/bin/bash
This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.
Medium
Shell command substitution
TOTP_CODE=$(oathtool --totp -b "$TOTP_SECRET")
The example generates a TOTP code from a secret in a shell workflow. This is legitimate automation but handles MFA secrets and deserves review.
Medium
Shell command substitution
RESULT=$(infsh app run agent-browser --function open --session new --input '{
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
SESSION_ID=$(echo $RESULT | jq -r '.session_id')
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
CLOSE_RESULT=$(infsh app run agent-browser --function close --session $SESSION_ID --input '{}' 2>/de
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
VIDEO=$(echo $CLOSE_RESULT | jq -r '.video // empty')
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
RESULT=$(infsh app run agent-browser --function open --session new --input '{
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
SESSION_ID=$(echo $RESULT | jq -r '.session_id')
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
URL=$(echo $RESULT | jq -r '.url')
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
TITLE=$(echo $RESULT | jq -r '.title')
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
RESULT=$(infsh app run agent-browser --function open --session new --input '{
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
SESSION_ID=$(echo $RESULT | jq -r '.session_id')
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Low
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh && infsh login
The URL is the remote installer endpoint used by the pipe-to-shell command. The URL itself is expected, but it contributes to the remote code execution installation risk.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (6)
RISK-001 Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh && infsh login
Line 17 pipes a downloaded installer from https://cli.inference.sh directly into sh. If the endpoint or transport is compromised, this executes remote code on the user machine.
RISK-002 High
Screen capture upload
description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e
The skill description declares screenshots and video recording for browser sessions. Captured pages can contain credentials, tokens, or private records returned through an external service.
RISK-003 High
Arbitrary Page JavaScript And Cookie Extraction
The execute function runs supplied JavaScript in the page context, and the authentication guide shows extracting document.cookie. This can expose active sessions or protected page data.
The command reference documents arbitrary JavaScript execution, and the authentication guide applies it to cookie extraction. The risk is direct and tied to authenticated browsing.
RISK-004 High
Proxy Rotation For Rate Limit Avoidance
The proxy guide includes a rate-limit avoidance workflow that rotates proxies while scraping pages. This can support evasion of service limits or source attribution.
The heading and sample workflow explicitly describe rotating proxies for web scraping under rate-limit avoidance. Legitimate testing is possible, but the abuse path is clear.
RISK-005 High
Sensitive Session Recording And Artifact Storage
The video guide records browser activity and includes an administrative task recording workflow that stores video artifacts. These files can capture secrets or private records.
The guide documents full-session recording and later warns not to record sensitive sessions. That warning confirms the realistic exposure risk.
RISK-006 High
Local File Upload Capability
The interact action supports uploading local file paths through browser file inputs. Misuse could send unintended local files to web applications.
Both the main skill and command reference document file_paths for upload actions. This is a legitimate feature with a concrete exfiltration risk if misused.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalPipe-to-shell installer in the quick start.Replace curl-to-sh installation with pinned release downloads, checksum verification, and a manual install path before login.
- FIX-002HighScreenshots and recordings can capture sensitive browser content.Add stronger default guidance to disable recording on authenticated, payment, admin, or private data pages.
- FIX-003HighCookie extraction and arbitrary page JavaScript are documented together.Remove cookie extraction examples or require explicit user approval and redaction for any session data handling.
- FIX-004HighProxy documentation includes rate-limit avoidance language.Reframe proxy support around approved testing and remove evasion examples, including proxy rotation for scraping.
- FIX-005MediumShell templates execute external commands and handle browser artifacts.Mark templates as review-before-run, validate user-supplied URLs, and avoid writing sensitive outputs to disk by default.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable