Versioned security assessment

Report ID: SA-D71C7417

7/12/2026, 9:36:20 AM

agent-browser security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
agent-browser
Version
v4
Maintainer
101-skills
Source
github.com/101-skills/skills/tree/main/tools/utilities/agent-browser/
Coverage
10 Files scanned · 2,315 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

4 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static alerts are Markdown syntax, examples, relative links, or routine shell redirection. Confirmed concerns include external dependency installation and SOCKS proxy routing. Semantic review found remote credential handling, cookie logging, local file uploads, and browser-scoped JavaScript execution, with no prompt injection evidence.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

10 Files scanned · 2,315 Lines analyzed

8 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 50 evidence locations

Filesystem access

May read or write local files.

Observed in 17 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 51 evidence locations

Capability review items (4)
High
references/proxy-support.md:152
SOCKS proxy
"proxy_url": "socks5://privacy-proxy.example.com:1080"
The proxy documentation explicitly supports SOCKS5 routing for browser traffic. An untrusted proxy can observe connection metadata, capture plaintext traffic, or interfere with requests.
High
references/proxy-support.md:165
SOCKS proxy
### SOCKS5 Proxy
The proxy documentation explicitly supports SOCKS5 routing for browser traffic. An untrusted proxy can observe connection metadata, capture plaintext traffic, or interfere with requests.
High
references/proxy-support.md:168
SOCKS proxy
{"proxy_url": "socks5://proxy.example.com:1080"}
The proxy documentation explicitly supports SOCKS5 routing for browser traffic. An untrusted proxy can observe connection metadata, capture plaintext traffic, or interfere with requests.
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
This line instructs users to run npx against the external belt-sh/cli skill. Installation expands the trusted supply chain and may execute third-party package behavior.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (4)

RISK-001 High
SKILL.md:158-167
Local File Upload Can Expose Files
The upload action accepts local file paths and sends selected files to a web form. An agent must not choose files without explicit approval.
The documented upload example explicitly supplies file_paths to a browser file input. The capability is clear, although the example path is a placeholder.
RISK-002 High
references/authentication.md:209-219
Session Cookies Are Printed to Output
The authentication guide extracts document cookies and prints them to the terminal. Session tokens can persist in logs and expose authenticated access.
The example assigns document.cookie to COOKIES and echoes the value. This is direct disclosure of potentially sensitive session material.
RISK-003 High
SKILL.md:9-17references/authentication.md:24-38
Credentials Pass Through a Hosted Browser Service
The login example sends usernames and passwords through agent-browser on inference.sh. Users must trust the hosted service with plaintext authentication data.
SKILL.md identifies inference.sh as the browser provider, while the authentication example passes a password to that browser session. The remote data flow is explicit.
RISK-004 Medium
SKILL.md:182-190
Arbitrary Page JavaScript Execution
The execute function runs custom JavaScript in the active page. It can read or alter page data within an authenticated browser session.
The skill explicitly documents custom JavaScript execution and shows a page query. The execution is browser-scoped, not host code execution.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    File uploads can expose local content.
    Require explicit approval for every upload and restrict file paths to a user-selected allowlist.
  2. FIX-002
    High
    Cookie values are printed to terminal output.
    Remove cookie echoing, redact session tokens, and correct the inaccurate claim about accessing httpOnly cookies.
  3. FIX-003
    High
    Credentials are sent through a hosted browser service.
    Disclose remote processing, disable recording during login, and require confirmation before sending passwords or one-time codes.
  4. FIX-004
    High
    Proxy and JavaScript features permit broad browser actions.
    Add domain and proxy allowlists, block private network targets by default, and confirm custom JavaScript before execution.
  5. FIX-005
    Medium
    The setup installs an external CLI skill through npx.
    Pin a reviewed version and checksum, identify the publisher, and explain what installation executes.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
d71c7417a35d5c2624161bd2fe8de8a41a362128
Content hash
433ed471ceca49f696ba72856894860594a5dccbcac82da61797ae7a3a3ebfef
Tree hash
9217592db0c540dbb41db26b2a752f111a2b3008d156a9cfe4edc7f56b71639d
Skill path
skills/101-skills/agent-browser
Audit payload hash
2031c951a9ea20818130174b23fbc6f3

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable