Versioned security assessment

Report ID: SA-3CAB8AB6

7/9/2026, 11:09:36 AM

agent-browser security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
agent-browser
Version
v2
Maintainer
101-skills
Source
github.com/101-skills/skills/tree/main/tools/utilities/agent-browser/
Coverage
10 Files scanned · 2,315 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

5 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Many static findings are markdown, example URL, relative-link, or cleanup-pattern false positives. Confirmed risk remains because the skill enables remote browser automation with external CLI commands, screenshots, video, proxies, authenticated sessions, file uploads, and page JavaScript. No prompt injection attempt was found in the reviewed files.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

10 Files scanned · 2,315 Lines analyzed

77 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 50 evidence locations

Filesystem access

May read or write local files.

Observed in 17 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 89 evidence locations

Capability review items (72)
High
references/authentication.md:215-217
Shell command substitution
RESULT=$(belt app run agent-browser --function execute --session $SESSION --input '{
The command substitution invokes the external browser CLI execute function and captures returned page data. Page JavaScript execution can extract sensitive content from authorized sessions.
High
references/authentication.md:222-223
Shell command substitution
RESULT=$(belt app run agent-browser --function execute --session $SESSION --input '{
The command substitution invokes the external browser CLI execute function and captures returned page data. Page JavaScript execution can extract sensitive content from authorized sessions.
High
references/proxy-support.md:119-121
Shell command substitution
RESULT=$(belt app run agent-browser --function execute --session $SESSION --input '{
The command substitution invokes the external browser CLI execute function and captures returned page data. Page JavaScript execution can extract sensitive content from authorized sessions.
High
references/proxy-support.md:192-194
Shell command substitution
RESULT=$(belt app run agent-browser --function execute --session $SESSION --input '{
The command substitution invokes the external browser CLI execute function and captures returned page data. Page JavaScript execution can extract sensitive content from authorized sessions.
High
references/proxy-support.md:152
SOCKS proxy
"proxy_url": "socks5://privacy-proxy.example.com:1080"
The documentation explicitly supports SOCKS5 and privacy proxy routing. Combined with browser automation and scraping guidance, this can hide origin and bypass site controls.
High
references/proxy-support.md:165
SOCKS proxy
### SOCKS5 Proxy
The documentation explicitly supports SOCKS5 and privacy proxy routing. Combined with browser automation and scraping guidance, this can hide origin and bypass site controls.
High
references/proxy-support.md:168
SOCKS proxy
{"proxy_url": "socks5://proxy.example.com:1080"}
The documentation explicitly supports SOCKS5 and privacy proxy routing. Combined with browser automation and scraping guidance, this can hide origin and bypass site controls.
High
templates/authenticated-session.sh:127-128
Shell command substitution
# # RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{
The command substitution invokes the external browser CLI execute function and captures returned page data. Page JavaScript execution can extract sensitive content from authorized sessions.
High
templates/capture-workflow.sh:105-107
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{
The command substitution invokes the external browser CLI execute function and captures returned page data. Page JavaScript execution can extract sensitive content from authorized sessions.
High
templates/capture-workflow.sh:114-115
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{
The command substitution invokes the external browser CLI execute function and captures returned page data. Page JavaScript execution can extract sensitive content from authorized sessions.
High
templates/capture-workflow.sh:126-127
Shell command substitution
# RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{
The command substitution invokes the external browser CLI execute function and captures returned page data. Page JavaScript execution can extract sensitive content from authorized sessions.
High
templates/capture-workflow.sh:132-133
Shell command substitution
# RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{
The command substitution invokes the external browser CLI execute function and captures returned page data. Page JavaScript execution can extract sensitive content from authorized sessions.
High
templates/capture-workflow.sh:138-139
Shell command substitution
# RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{
The command substitution invokes the external browser CLI execute function and captures returned page data. Page JavaScript execution can extract sensitive content from authorized sessions.
Medium
references/authentication.md:24-26
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/authentication.md:51
Shell command substitution
RESULT=$(belt app run agent-browser --function snapshot --session $SESSION --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/authentication.md:70-72
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/authentication.md:80
Shell command substitution
RESULT=$(belt app run agent-browser --function snapshot --session $SESSION --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/authentication.md:97
Shell command substitution
RESULT=$(belt app run agent-browser --function snapshot --session $SESSION --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/authentication.md:115
Shell command substitution
RESULT=$(belt app run agent-browser --function snapshot --session $SESSION --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/authentication.md:128
Shell command substitution
RESULT=$(belt app run agent-browser --function snapshot --session $SESSION --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/authentication.md:133
Shell command substitution
TOTP_CODE=$(oathtool --totp -b "$TOTP_SECRET")
The command reads or derives authentication secrets into shell variables. It is documented as a setup pattern but still handles sensitive material.
Medium
references/authentication.md:153-156
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/authentication.md:179-181
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/authentication.md:202
Shell command substitution
SESSION=$(login)
The substitution calls a documented login helper that creates an authenticated browser session. It is legitimate, but it handles sensitive session state.
Medium
references/authentication.md:243
Shell command substitution
export PASSWORD=$(cat /path/to/secure/password)
The command reads or derives authentication secrets into shell variables. It is documented as a setup pattern but still handles sensitive material.
Medium
references/authentication.md:246
Shell command substitution
export PASSWORD=$(vault read -field=password secret/app)
The command reads or derives authentication secrets into shell variables. It is documented as a setup pattern but still handles sensitive material.
Medium
references/proxy-support.md:22-25
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/proxy-support.md:35-40
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/proxy-support.md:65-68
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/proxy-support.md:76
Shell command substitution
RESULT=$(belt app run agent-browser --function snapshot --session $SESSION --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/proxy-support.md:113-116
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/proxy-support.md:137-142
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/proxy-support.md:150-153
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/proxy-support.md:186-189
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/proxy-support.md:267-270
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/session-management.md:33-35
Shell command substitution
RESULT=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/session-management.md:89-91
Shell command substitution
RESULT1=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/session-management.md:94-96
Shell command substitution
RESULT2=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/session-management.md:140-142
Shell command substitution
SESSION_ID=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/session-management.md:183
Shell command substitution
RESULT=$(belt app run agent-browser --function snapshot --session $SESSION_ID --input '{}' 2>&1)
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/session-management.md:186-188
Shell command substitution
SESSION_ID=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/snapshot-refs.md:124-126
Shell command substitution
RESULT=$(belt app run agent-browser --function interact --session $SESSION --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/snapshot-refs.md:136-138
Shell command substitution
RESULT=$(belt app run agent-browser --function interact --session $SESSION --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/video-recording.md:23-26
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/video-recording.md:38
Shell command substitution
RESULT=$(belt app run agent-browser --function close --session $SESSION --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/video-recording.md:48-52
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/video-recording.md:87-90
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/video-recording.md:93-95
Shell command substitution
RESULT=$(belt app run agent-browser --function interact --session $SESSION --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/video-recording.md:103
Shell command substitution
CLOSE_RESULT=$(belt app run agent-browser --function close --session $SESSION --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/video-recording.md:119-124
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/video-recording.md:156
Shell command substitution
RESULT=$(belt app run agent-browser --function close --session $SESSION --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/video-recording.md:168-171
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/video-recording.md:178
Shell command substitution
CLOSE_RESULT=$(belt app run agent-browser --function close --session $SESSION --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/video-recording.md:197-200
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
references/video-recording.md:206
Shell command substitution
RESULT=$(belt app run agent-browser --function close --session $SESSION --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
SKILL.md:38-40
Shell command substitution
RESULT=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
SKILL.md:118-122
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
SKILL.md:217-219
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
SKILL.md:235-237
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
SKILL.md:250-253
Shell command substitution
SESSION=$(belt app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
SKILL.md:261
Shell command substitution
RESULT=$(belt app run agent-browser --function close --session $SESSION --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
templates/authenticated-session.sh:40-42
Shell command substitution
RESULT=$(infsh app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
templates/authenticated-session.sh:70-73
Shell command substitution
# RESULT=$(infsh app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
templates/authenticated-session.sh:97
Shell command substitution
# RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
templates/authenticated-session.sh:1
Unix shell invocation
#!/bin/bash
This is an executable shell template that invokes the hosted browser CLI, creates network sessions, and writes local output files. The script is legitimate but expands execution risk.
Medium
templates/capture-workflow.sh:28
Shell command substitution
CLOSE_RESULT=$(infsh app run agent-browser --function close --session $SESSION_ID --input '{}' 2>/de
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
templates/capture-workflow.sh:54-59
Shell command substitution
RESULT=$(infsh app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
templates/capture-workflow.sh:86
Shell command substitution
RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
templates/capture-workflow.sh:1
Unix shell invocation
#!/bin/bash
This is an executable shell template that invokes the hosted browser CLI, creates network sessions, and writes local output files. The script is legitimate but expands execution risk.
Medium
templates/form-automation.sh:30-32
Shell command substitution
RESULT=$(infsh app run agent-browser --function open --session new --input '{
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
templates/form-automation.sh:102
Shell command substitution
# RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')
The command substitution runs the external belt or infsh browser CLI and captures remote browser results. This is core functionality but can drive network actions and collect page data.
Medium
templates/form-automation.sh:1
Unix shell invocation
#!/bin/bash
This is an executable shell template that invokes the hosted browser CLI, creates network sessions, and writes local output files. The script is legitimate but expands execution risk.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (5)

RISK-001 High
SKILL.md:3
Screen capture upload
description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e
The skill advertises screenshots and video recording from remote browser sessions. These captures can include credentials, private pages, or regulated data.
RISK-002 High
references/authentication.md:31-38references/authentication.md:120-144references/authentication.md:209-219
Credential and Cookie Exposure Workflows
The authentication guide instructs users to fill passwords, generate TOTP codes, reuse authenticated sessions, and extract cookies. This is legitimate automation guidance, but it creates high-impact risk if used on accounts without strong data handling controls.
The cited sections directly handle passwords, TOTP secrets, authenticated sessions, and cookies. The file also includes safety notes, but the sensitive workflow is explicit.
RISK-003 High
references/proxy-support.md:85-128references/proxy-support.md:145-153references/proxy-support.md:280-286
Proxy Rotation and Anonymity Guidance
The proxy guide describes rotating proxies for rate limit avoidance and privacy-focused proxy routing. This can support authorized geo-testing, but it also enables evasion of site controls and origin attribution.
The guide explicitly labels proxy rotation for rate limit avoidance and documents privacy proxy use. It later asks users to respect rate limits, but the evasion-capable workflow remains present.
RISK-004 High
references/commands.md:162-177templates/capture-workflow.sh:103-118references/snapshot-refs.md:225-228
Arbitrary Page JavaScript and Data Extraction
The skill documents an execute function that runs JavaScript in the page and templates that extract body text and links. This can be useful for testing, but it can also collect sensitive data from authenticated or private pages.
The files directly describe arbitrary in-page JavaScript execution and automated extraction of page text or links. No target authorization enforcement is shown in the skill files.
RISK-005 High
references/video-recording.md:66-78references/video-recording.md:189-211references/video-recording.md:259-270
Sensitive Screen Recording Context
The video guide records browser activity and returns video files, including examples for admin pages and test artifacts. The documentation warns against sensitive recording, but the capability can still expose credentials, private workflows, or regulated data.
The cited lines describe captured browser activity, admin workflow recording, and a direct warning about sensitive data. This confirms both capability and risk context.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Sensitive browser screenshots and recordings
    Add explicit consent checks before recording, disable video by default for login or admin flows, and document redaction requirements for shared artifacts.
  2. FIX-002
    High
    Credential, TOTP, session, and cookie handling
    Remove cookie extraction examples, require secret-manager usage for credentials, and warn users not to expose session output in logs or screenshots.
  3. FIX-003
    High
    Proxy rotation and rate-limit avoidance guidance
    Remove rate-limit avoidance language, require authorization for proxy use, and frame proxy support around testing, corporate access, or compliance-approved scenarios.
  4. FIX-004
    Medium
    Shell templates accept arbitrary URLs and output paths
    Validate URL schemes, quote variables consistently, restrict output directories, and add warnings before file upload or execute actions.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable