Audit History

references/proxy-support.md:85-128

Screen capture upload

description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e

The skill intentionally captures screenshots and videos through a hosted inference.sh browser. Captured pages may contain credentials or personal data outside the local trust boundary.

High

Rate-Limit Evasion Guidance

Documentation explicitly recommends rotating proxies for rate-limit avoidance during scraping. This facilitates bypassing service controls and can support abusive collection.

The section is titled Rate Limit Avoidance and provides a complete proxy-rotation loop for scraping multiple pages.

High

references/authentication.md:31-38 references/authentication.md:99-102 references/authentication.md:128-138 references/authentication.md:209-219

Hosted Handling of Authentication Secrets

Examples send passwords and TOTP codes through hosted browser commands, then extract and print session cookies. This can expose account secrets outside the local environment.

The examples explicitly pass password and TOTP values to agent-browser and print document cookies to standard output.

High

references/snapshot-refs.md:24-29 references/snapshot-refs.md:147-157

Untrusted Web Content Reaches Agent Context

Snapshots convert remote page text into compact input for AI decisions without warning that pages may contain malicious instructions. This creates a prompt-injection surface.

The guide explicitly positions elements_text as input for AI decisions but provides no boundary for instructions embedded in remote page content.

High

SKILL.md:73-91 SKILL.md:158-189

Consequential Browser Actions Without Guardrails

The skill enables submissions, local file uploads, arbitrary page JavaScript, proxying, and authenticated browsing. These actions can disclose data or change accounts.

The action table and examples explicitly document file upload, form interaction, navigation, and arbitrary JavaScript without confirmation or domain restrictions.

Medium

SKILL.md:7 SKILL.md:17

Unpinned External CLI Dependency

The skill directs users to install an external CLI skill and follow remote installation instructions without a pinned version. Upstream changes could alter executed behavior.

Both installation references resolve mutable remote content, and neither instruction pins a reviewed version or integrity digest.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SOCKS proxy

"proxy_url": "socks5://privacy-proxy.example.com:1080"

The documentation intentionally enables SOCKS5 traffic anonymization. Combined with scraping and proxy-rotation guidance, this can bypass network or service controls.

High

SOCKS proxy

### SOCKS5 Proxy

The documentation intentionally enables SOCKS5 traffic anonymization. Combined with scraping and proxy-rotation guidance, this can bypass network or service controls.

High

references/authentication.md:5 references/authentication.md:263 references/commands.md:3 references/commands.md:59 references/proxy-support.md:5 references/proxy-support.md:272 references/snapshot-refs.md:5 references/video-recording.md:5 references/video-recording.md:239 templates/authenticated-session.sh:30 templates/capture-workflow.sh:28 templates/capture-workflow.sh:78 templates/capture-workflow.sh:81 templates/capture-workflow.sh:149 templates/form-automation.sh:23

SOCKS proxy

{"proxy_url": "socks5://proxy.example.com:1080"}

The documentation intentionally enables SOCKS5 traffic anonymization. Combined with scraping and proxy-rotation guidance, this can bypass network or service controls.

Low

SKILL.md:13

Hardcoded URL

![Agentic Browser](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgjw8atdxgkrs

The Markdown image embeds an externally hosted inference.sh asset, so rendering can issue an unsolicited request and disclose viewer network metadata. This is a low privacy risk.

Risk Factors

⚙️ External commands (50)

🌐 Network access (50)

📁 Filesystem access (15)

Detected Patterns

Screen capture upload

Audited by: codex

Audit version 4

Jul 12, 2026, 09:36 AM

Most static alerts are Markdown syntax, examples, relative links, or routine shell redirection. Confirmed concerns include external dependency installation and SOCKS proxy routing. Semantic review found remote credential handling, cookie logging, local file uploads, and browser-scoped JavaScript execution, with no prompt injection evidence.

Files scanned

2,315

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

High

SKILL.md:158-167

Local File Upload Can Expose Files

The upload action accepts local file paths and sends selected files to a web form. An agent must not choose files without explicit approval.

The documented upload example explicitly supplies file_paths to a browser file input. The capability is clear, although the example path is a placeholder.

High

references/authentication.md:209-219

Session Cookies Are Printed to Output

The authentication guide extracts document cookies and prints them to the terminal. Session tokens can persist in logs and expose authenticated access.

The example assigns document.cookie to COOKIES and echoes the value. This is direct disclosure of potentially sensitive session material.

High

SKILL.md:9-17 references/authentication.md:24-38

Credentials Pass Through a Hosted Browser Service

The login example sends usernames and passwords through agent-browser on inference.sh. Users must trust the hosted service with plaintext authentication data.

SKILL.md identifies inference.sh as the browser provider, while the authentication example passes a password to that browser session. The remote data flow is explicit.

Medium

SKILL.md:182-190

Arbitrary Page JavaScript Execution

The execute function runs custom JavaScript in the active page. It can read or alter page data within an authenticated browser session.

The skill explicitly documents custom JavaScript execution and shows a page query. The execution is browser-scoped, not host code execution.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SOCKS proxy

"proxy_url": "socks5://privacy-proxy.example.com:1080"

The proxy documentation explicitly supports SOCKS5 routing for browser traffic. An untrusted proxy can observe connection metadata, capture plaintext traffic, or interfere with requests.

High

SOCKS proxy

### SOCKS5 Proxy

The proxy documentation explicitly supports SOCKS5 routing for browser traffic. An untrusted proxy can observe connection metadata, capture plaintext traffic, or interfere with requests.

High

SOCKS proxy

{"proxy_url": "socks5://proxy.example.com:1080"}

The proxy documentation explicitly supports SOCKS5 routing for browser traffic. An untrusted proxy can observe connection metadata, capture plaintext traffic, or interfere with requests.

Medium

SKILL.md:7

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

This line instructs users to run npx against the external belt-sh/cli skill. Installation expands the trusted supply chain and may execute third-party package behavior.

Risk Factors

⚙️ External commands (50)

🌐 Network access (50)

📁 Filesystem access (17)

Audited by: codex

Audit version 3

Jul 8, 2026, 02:18 PM

Most static hits are documentation examples or Markdown syntax, including path traversal and hardcoded example URLs. I confirmed the executable shell templates, SOCKS proxy support, and screen capture or video behavior as real security-sensitive capabilities. Semantic review also found sensitive risks around cookies, TOTP flows, file uploads, page JavaScript execution, and proxy-based rate limit avoidance.

Files scanned

2,315

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (6)

High

SKILL.md:3-4 SKILL.md:66-71 SKILL.md:116-128

Screen capture upload

description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e

The skill description explicitly advertises screenshots and video recording of browser sessions. Captures may include sensitive page data and are returned through the browser service.

High

Remote Browser Capture Can Expose Sensitive Data

The skill drives browser sessions through inference.sh and returns screenshots or videos. Captured pages may include credentials, private records, or internal application data.

The skill explicitly names inference.sh, screenshots, and video recording. These are intended features, but they create a clear privacy exposure risk.

High

references/authentication.md:120-144 references/authentication.md:169-206 references/authentication.md:209-224

Credential and Session Cookie Exposure Guidance

The authentication guide covers TOTP generation, reusable authenticated sessions, cookie extraction, and printing cookies. This can expose account secrets or reusable session tokens.

The cited text directly shows TOTP use, persistent authenticated sessions, document.cookie extraction, and cookie logging. This is strong evidence of sensitive session data handling.

High

references/proxy-support.md:85-127 references/proxy-support.md:145-153

Proxy Rotation for Rate Limit Avoidance

The proxy guide includes a section titled rate limit avoidance and shows rotating proxies for scraping. This can enable abuse of site controls.

The section explicitly names rate limit avoidance and combines scraping with proxy rotation. Legitimate testing is possible, but the abuse-enablement signal is clear.

High

SKILL.md:158-167 references/commands.md:84-91

Local File Upload Capability

The skill can upload local file paths to web file inputs. If misused, this can move local documents to external sites through the automated browser.

The action table and file upload example explicitly support file_paths. The risk depends on user intent, but the exfiltration pathway is real.

High

references/commands.md:162-184 references/commands.md:188-208 references/authentication.md:213-224

Arbitrary JavaScript Execution in Page Context

The command reference allows user-supplied JavaScript to run in the current page and return results. This can extract page content or session-visible data.

The reference documents a code field for JavaScript execution and gives extraction examples. Cookie extraction guidance confirms the sensitive-data impact.

Capability review items (19)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SOCKS proxy

"proxy_url": "socks5://privacy-proxy.example.com:1080"

The documentation explicitly supports SOCKS proxy routing, including privacy and anonymity examples. Proxy routing can obscure origin and bypass network controls.

High

SOCKS proxy

### SOCKS5 Proxy

The documentation explicitly supports SOCKS proxy routing, including privacy and anonymity examples. Proxy routing can obscure origin and bypass network controls.

High

templates/authenticated-session.sh:40-42 templates/capture-workflow.sh:54-59 templates/form-automation.sh:30-32

SOCKS proxy

{"proxy_url": "socks5://proxy.example.com:1080"}

The documentation explicitly supports SOCKS proxy routing, including privacy and anonymity examples. Proxy routing can obscure origin and bypass network controls.

Medium

Shell command substitution · 3 occurrences

RESULT=$(infsh app run agent-browser --function open --session new --input '{

This executable template runs infsh or jq through shell substitution when invoked. The usage is intended but still performs real external command execution with network-capable browser sessions.

Medium

templates/authenticated-session.sh:43 templates/capture-workflow.sh:60 templates/form-automation.sh:33

Shell command substitution · 3 occurrences

SESSION_ID=$(echo $RESULT | jq -r '.session_id')

This executable template runs infsh or jq through shell substitution when invoked. The usage is intended but still performs real external command execution with network-capable browser sessions.

Medium

templates/authenticated-session.sh:1 templates/capture-workflow.sh:1 templates/form-automation.sh:1

Unix shell invocation · 3 occurrences

#!/bin/bash

This is an executable Bash template. Running it grants the script local shell access and external CLI execution, even though the commands are intended.

Medium

templates/capture-workflow.sh:28

Shell command substitution

CLOSE_RESULT=$(infsh app run agent-browser --function close --session $SESSION_ID --input '{}' 2>/de

This executable template runs infsh or jq through shell substitution when invoked. The usage is intended but still performs real external command execution with network-capable browser sessions.

Medium

templates/capture-workflow.sh:31

Shell command substitution

VIDEO=$(echo $CLOSE_RESULT | jq -r '.video // empty')

This executable template runs infsh or jq through shell substitution when invoked. The usage is intended but still performs real external command execution with network-capable browser sessions.

Medium

templates/capture-workflow.sh:63

Shell command substitution

URL=$(echo $RESULT | jq -r '.url')

This executable template runs infsh or jq through shell substitution when invoked. The usage is intended but still performs real external command execution with network-capable browser sessions.

Medium

templates/capture-workflow.sh:64

Shell command substitution

TITLE=$(echo $RESULT | jq -r '.title')

This executable template runs infsh or jq through shell substitution when invoked. The usage is intended but still performs real external command execution with network-capable browser sessions.

Medium

templates/capture-workflow.sh:86

Shell command substitution

RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')

This executable template runs infsh or jq through shell substitution when invoked. The usage is intended but still performs real external command execution with network-capable browser sessions.

Medium

templates/capture-workflow.sh:105-107 templates/capture-workflow.sh:114-115

Shell command substitution · 2 occurrences

RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{

This executable template runs infsh or jq through shell substitution when invoked. The usage is intended but still performs real external command execution with network-capable browser sessions.

Risk Factors

⚙️ External commands (184)

🌐 Network access (60)

📁 Filesystem access (17)

Detected Patterns

Screen capture upload

Audited by: codex

Audit version 2

Jul 9, 2026, 11:09 AM

Many static findings are markdown, example URL, relative-link, or cleanup-pattern false positives. Confirmed risk remains because the skill enables remote browser automation with external CLI commands, screenshots, video, proxies, authenticated sessions, file uploads, and page JavaScript. No prompt injection attempt was found in the reviewed files.

Files scanned

2,315

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (5)

High

references/authentication.md:31-38 references/authentication.md:120-144 references/authentication.md:209-219

Screen capture upload

description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e

The skill advertises screenshots and video recording from remote browser sessions. These captures can include credentials, private pages, or regulated data.

High

Credential and Cookie Exposure Workflows

The authentication guide instructs users to fill passwords, generate TOTP codes, reuse authenticated sessions, and extract cookies. This is legitimate automation guidance, but it creates high-impact risk if used on accounts without strong data handling controls.

The cited sections directly handle passwords, TOTP secrets, authenticated sessions, and cookies. The file also includes safety notes, but the sensitive workflow is explicit.

High

references/proxy-support.md:85-128 references/proxy-support.md:145-153 references/proxy-support.md:280-286

Proxy Rotation and Anonymity Guidance

The proxy guide describes rotating proxies for rate limit avoidance and privacy-focused proxy routing. This can support authorized geo-testing, but it also enables evasion of site controls and origin attribution.

The guide explicitly labels proxy rotation for rate limit avoidance and documents privacy proxy use. It later asks users to respect rate limits, but the evasion-capable workflow remains present.

High

references/commands.md:162-177 templates/capture-workflow.sh:103-118 references/snapshot-refs.md:225-228

Arbitrary Page JavaScript and Data Extraction

The skill documents an execute function that runs JavaScript in the page and templates that extract body text and links. This can be useful for testing, but it can also collect sensitive data from authenticated or private pages.

The files directly describe arbitrary in-page JavaScript execution and automated extraction of page text or links. No target authorization enforcement is shown in the skill files.

High

references/video-recording.md:66-78 references/video-recording.md:189-211 references/video-recording.md:259-270

Sensitive Screen Recording Context

The video guide records browser activity and returns video files, including examples for admin pages and test artifacts. The documentation warns against sensitive recording, but the capability can still expose credentials, private workflows, or regulated data.

The cited lines describe captured browser activity, admin workflow recording, and a direct warning about sensitive data. This confirms both capability and risk context.

Capability review items (72)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/authentication.md:215-217 references/authentication.md:222-223 references/proxy-support.md:119-121 references/proxy-support.md:192-194

Shell command substitution · 4 occurrences

RESULT=$(belt app run agent-browser --function execute --session $SESSION --input '{

The command substitution invokes the external browser CLI execute function and captures returned page data. Page JavaScript execution can extract sensitive content from authorized sessions.

High

SOCKS proxy

"proxy_url": "socks5://privacy-proxy.example.com:1080"

The documentation explicitly supports SOCKS5 and privacy proxy routing. Combined with browser automation and scraping guidance, this can hide origin and bypass site controls.

High

SOCKS proxy

### SOCKS5 Proxy

The documentation explicitly supports SOCKS5 and privacy proxy routing. Combined with browser automation and scraping guidance, this can hide origin and bypass site controls.

High

templates/authenticated-session.sh:127-128

SOCKS proxy

{"proxy_url": "socks5://proxy.example.com:1080"}

The documentation explicitly supports SOCKS5 and privacy proxy routing. Combined with browser automation and scraping guidance, this can hide origin and bypass site controls.

High

Shell command substitution

# # RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{

The command substitution invokes the external browser CLI execute function and captures returned page data. Page JavaScript execution can extract sensitive content from authorized sessions.

High

templates/capture-workflow.sh:105-107 templates/capture-workflow.sh:114-115

Shell command substitution · 2 occurrences

RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{

The command substitution invokes the external browser CLI execute function and captures returned page data. Page JavaScript execution can extract sensitive content from authorized sessions.

High

templates/capture-workflow.sh:126-127 templates/capture-workflow.sh:132-133 templates/capture-workflow.sh:138-139

Shell command substitution · 3 occurrences

# RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{

The command substitution invokes the external browser CLI execute function and captures returned page data. Page JavaScript execution can extract sensitive content from authorized sessions.

Medium

references/authentication.md:24-26 references/authentication.md:70-72 references/authentication.md:153-156 references/authentication.md:179-181 references/proxy-support.md:22-25 references/proxy-support.md:35-40 references/proxy-support.md:65-68 references/proxy-support.md:113-116 references/proxy-support.md:137-142 references/proxy-support.md:150-153 references/proxy-support.md:186-189 references/proxy-support.md:267-270 references/video-recording.md:23-26 references/video-recording.md:48-52 references/video-recording.md:87-90 references/video-recording.md:119-124 references/video-recording.md:168-171 references/video-recording.md:197-200 SKILL.md:118-122 SKILL.md:217-219 SKILL.md:235-237 SKILL.md:250-253

Shell command substitution · 22 occurrences

SESSION=$(belt app run agent-browser --function open --session new --input '{

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Medium

references/authentication.md:51 references/authentication.md:80 references/authentication.md:97 references/authentication.md:115 references/authentication.md:128 references/proxy-support.md:76

Shell command substitution · 6 occurrences

RESULT=$(belt app run agent-browser --function snapshot --session $SESSION --input '{}')

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Medium

references/authentication.md:133

Shell command substitution

TOTP_CODE=$(oathtool --totp -b "$TOTP_SECRET")

The command reads or derives authentication secrets into shell variables. It is documented as a setup pattern but still handles sensitive material.

Medium

references/authentication.md:202

Shell command substitution

SESSION=$(login)

The substitution calls a documented login helper that creates an authenticated browser session. It is legitimate, but it handles sensitive session state.

Medium

references/authentication.md:243

Shell command substitution

export PASSWORD=$(cat /path/to/secure/password)

The command reads or derives authentication secrets into shell variables. It is documented as a setup pattern but still handles sensitive material.

Medium

references/authentication.md:246

Shell command substitution

export PASSWORD=$(vault read -field=password secret/app)

The command reads or derives authentication secrets into shell variables. It is documented as a setup pattern but still handles sensitive material.

Medium

references/session-management.md:33-35 SKILL.md:38-40

Shell command substitution · 2 occurrences

RESULT=$(belt app run agent-browser --function open --session new --input '{

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Medium

references/session-management.md:89-91

Shell command substitution

RESULT1=$(belt app run agent-browser --function open --session new --input '{

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Medium

references/session-management.md:94-96

Shell command substitution

RESULT2=$(belt app run agent-browser --function open --session new --input '{

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Medium

references/session-management.md:140-142 references/session-management.md:186-188

Shell command substitution · 2 occurrences

SESSION_ID=$(belt app run agent-browser --function open --session new --input '{

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Medium

references/session-management.md:183

Shell command substitution

RESULT=$(belt app run agent-browser --function snapshot --session $SESSION_ID --input '{}' 2>&1)

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Medium

references/snapshot-refs.md:124-126 references/snapshot-refs.md:136-138 references/video-recording.md:93-95

Shell command substitution · 3 occurrences

RESULT=$(belt app run agent-browser --function interact --session $SESSION --input '{

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Medium

references/video-recording.md:38 references/video-recording.md:156 references/video-recording.md:206 SKILL.md:261

Shell command substitution · 4 occurrences

RESULT=$(belt app run agent-browser --function close --session $SESSION --input '{}')

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Medium

references/video-recording.md:103 references/video-recording.md:178

Shell command substitution · 2 occurrences

CLOSE_RESULT=$(belt app run agent-browser --function close --session $SESSION --input '{}')

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Medium

templates/authenticated-session.sh:40-42 templates/capture-workflow.sh:54-59 templates/form-automation.sh:30-32

Shell command substitution · 3 occurrences

RESULT=$(infsh app run agent-browser --function open --session new --input '{

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Medium

templates/authenticated-session.sh:70-73

Shell command substitution

# RESULT=$(infsh app run agent-browser --function open --session new --input '{

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Medium

templates/authenticated-session.sh:97 templates/form-automation.sh:102

Shell command substitution · 2 occurrences

# RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Medium

templates/authenticated-session.sh:1 templates/capture-workflow.sh:1 templates/form-automation.sh:1

Unix shell invocation · 3 occurrences

#!/bin/bash

This is an executable shell template that invokes the hosted browser CLI, creates network sessions, and writes local output files. The script is legitimate but expands execution risk.

Medium

templates/capture-workflow.sh:28

Shell command substitution

CLOSE_RESULT=$(infsh app run agent-browser --function close --session $SESSION_ID --input '{}' 2>/de

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Medium

templates/capture-workflow.sh:86

Shell command substitution

RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')

The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.

Risk Factors

⚙️ External commands (50)

🌐 Network access (50)

📁 Filesystem access (17)

Detected Patterns

Screen capture upload

Audited by: codex

Audit version 1

Jul 8, 2026, 02:18 PM

Files scanned

2,315

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (6)

High

SKILL.md:3-4 SKILL.md:66-71 SKILL.md:116-128

Screen capture upload

description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e

The skill description explicitly advertises screenshots and video recording of browser sessions. Captures may include sensitive page data and are returned through the browser service.

High

Remote Browser Capture Can Expose Sensitive Data

The skill drives browser sessions through inference.sh and returns screenshots or videos. Captured pages may include credentials, private records, or internal application data.

The skill explicitly names inference.sh, screenshots, and video recording. These are intended features, but they create a clear privacy exposure risk.

High

references/authentication.md:120-144 references/authentication.md:169-206 references/authentication.md:209-224

Credential and Session Cookie Exposure Guidance

The authentication guide covers TOTP generation, reusable authenticated sessions, cookie extraction, and printing cookies. This can expose account secrets or reusable session tokens.

The cited text directly shows TOTP use, persistent authenticated sessions, document.cookie extraction, and cookie logging. This is strong evidence of sensitive session data handling.

High

references/proxy-support.md:85-127 references/proxy-support.md:145-153

Proxy Rotation for Rate Limit Avoidance

The proxy guide includes a section titled rate limit avoidance and shows rotating proxies for scraping. This can enable abuse of site controls.

The section explicitly names rate limit avoidance and combines scraping with proxy rotation. Legitimate testing is possible, but the abuse-enablement signal is clear.

High

SKILL.md:158-167 references/commands.md:84-91

Local File Upload Capability

The skill can upload local file paths to web file inputs. If misused, this can move local documents to external sites through the automated browser.

The action table and file upload example explicitly support file_paths. The risk depends on user intent, but the exfiltration pathway is real.

High

references/commands.md:162-184 references/commands.md:188-208 references/authentication.md:213-224

Arbitrary JavaScript Execution in Page Context

The command reference allows user-supplied JavaScript to run in the current page and return results. This can extract page content or session-visible data.

The reference documents a code field for JavaScript execution and gives extraction examples. Cookie extraction guidance confirms the sensitive-data impact.

Capability review items (19)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SOCKS proxy

"proxy_url": "socks5://privacy-proxy.example.com:1080"

The documentation explicitly supports SOCKS proxy routing, including privacy and anonymity examples. Proxy routing can obscure origin and bypass network controls.

High

SOCKS proxy

### SOCKS5 Proxy

The documentation explicitly supports SOCKS proxy routing, including privacy and anonymity examples. Proxy routing can obscure origin and bypass network controls.

High