Habilidades browser-use Histórico de Auditoria
🌐

Histórico de Auditoria

browser-use - 2 auditorias

Versão da auditoria 2

Mais recente Baixo Risco

Mar 19, 2026, 08:21 AM

Static analysis flagged 163 patterns in SKILL.md documentation file. All findings are false positives: backtick patterns are markdown code blocks documenting CLI usage, URLs are example/documentation links, and file paths reference user-controlled locations for legitimate browser profile and cookie management. The skill provides browser automation via the browser-use CLI with no malicious intent detected.

1
Arquivos analisados
547
Linhas analisadas
6
achados
claude
Auditado por
Problemas de Risco Médio (1)
Cookie Export/Import Capability
The skill supports exporting cookies to files and importing them, which could expose session tokens if misused. This is legitimate browser profile syncing functionality but should be documented.
Problemas de Baixo Risco (2)
External Command Documentation
SKILL.md contains extensive documentation of browser-use CLI commands. All instances are markdown code blocks for documentation purposes, not actual code execution.
Hardcoded URLs in Documentation
Multiple example URLs present in SKILL.md including github.com, example.com. These are documentation links and example values, not hardcoded endpoints for data exfiltration.

Fatores de risco

⚙️ Comandos externos (2)
🌐 Acesso à rede (2)
📁 Acesso ao sistema de arquivos (2)

Versão da auditoria 1

Baixo Risco

Jan 26, 2026, 07:53 AM

Static analysis flagged patterns in SKILL.md documentation as potential security risks. After evaluation, all findings are false positives: bash code blocks were misidentified as shell execution, example URLs were flagged as hardcoded network endpoints, and documented environment variables were misclassified as credential access. The skill is a legitimate browser automation CLI tool with no malicious code or behavior patterns.

1
Arquivos analisados
219
Linhas analisadas
7
achados
claude
Auditado por
Problemas de Risco Médio (3)
Documentation Code Blocks Misidentified as Shell Execution
Static analyzer flagged 67 instances of 'Ruby/shell backtick execution' in SKILL.md markdown file. These are bash code block examples (```bash ... ```) used for documentation purposes, not actual backtick shell execution.
Example URLs in Documentation Misidentified as Hardcoded Network Endpoints
Static analyzer flagged 6 hardcoded URLs in SKILL.md. These are example URLs (https://example.com, https://gmail.com, etc.) used in documentation to demonstrate CLI usage.
Documented Environment Variables Misclassified as Credential Access
Static analyzer flagged environment variable references (BROWSER_USE_API_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY) as credential access. These are documented configuration options for the CLI tool.
Problemas de Baixo Risco (1)
Base64 Encoding Reference in Screenshot Output
Documentation mentions base64 output for screenshots. Base64 is encoding, not cryptographic encryption.

Fatores de risco