Versioned security assessment

Report ID: SA-26EE580B

7/21/2026, 9:54:56 AM

agent-browser security assessment v7

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: claude Historical report
Skill name
agent-browser
Version
v7
Maintainer
101-skills
Source
github.com/101-skills/skills/tree/main/tools/utilities/agent-browser/
Coverage
10 Files scanned · 2,315 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

4 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static detections primarily match Markdown, shell examples, placeholders, and expected browser-automation documentation; they do not demonstrate hidden execution or embedded malware. The audit identified material capability risks: unrestricted belt CLI permission, third-party hosted processing of browser data, and rate-limit avoidance guidance through proxy rotation. Publication should require clear consent, narrowed permissions, and removal of evasion-oriented guidance.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

10 Files scanned · 2,315 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 50 evidence locations

Filesystem access

May read or write local files.

Observed in 17 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (4)

RISK-001 High
SKILL.md:4
Overbroad belt CLI command permission
The skill grants Bash access to every belt subcommand. This exceeds the documented browser workflow and permits unreviewed belt operations.
The allowed-tools declaration explicitly permits Bash(belt *) without a subcommand or argument restriction.
RISK-002 High
SKILL.md:7SKILL.md:17-23
Third-party installation and hosted browser processing
The instructions install a third-party CLI, authenticate it, and run browser sessions through inference.sh. Browsing state, entered credentials, uploads, screenshots, and recordings may be processed outside the local environment.
The skill explicitly instructs npx installation, belt login, and belt app run against inference.sh, establishing an external service dependency.
RISK-003 High
references/proxy-support.md:85-129
Rate-limit avoidance guidance
The proxy documentation presents proxy rotation for rate-limit avoidance. This can facilitate evasion of website controls and should not be marketed as a supported workflow.
The cited section is labeled for rate-limit avoidance and demonstrates rotating proxy endpoints across requests.
RISK-004 Medium
SKILL.md:145-189references/session-management.md:19-26
Sensitive browser data exposure capability
The skill supports authenticated sessions, local file uploads, screenshots, videos, proxy credentials, and in-page JavaScript. Used together, these features can expose sensitive data unless an operator controls destinations and data handling.
The documented features directly include proxy credentials, file paths, session persistence, recording, and page JavaScript execution.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Bash(belt *) permits every belt subcommand.
    Replace the wildcard permission with the smallest allowlist of required belt app run commands and reviewed arguments.
  2. FIX-002
    High
    Installation and remote browser processing are not accompanied by a data-handling warning.
    Explain what data reaches inference.sh, require explicit consent before login or remote sessions, and advise against production credentials and confidential uploads.
  3. FIX-003
    High
    Proxy rotation is framed as rate-limit avoidance.
    Remove rate-limit avoidance examples and state that proxies are only for authorized routing, testing, and compliance requirements.
  4. FIX-004
    Medium
    Browser capture, upload, session, and JavaScript features can expose sensitive information.
    Add confirmation checkpoints for uploads, recordings, form submission, JavaScript execution, and authenticated destinations.
  5. FIX-005
    Low
    Some templates invoke infsh while the main documentation requires belt.
    Use one documented CLI name consistently and validate templates before publication.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
26ee580b1dc4b5aed6b30c1dd62b327556bac8d8
Content hash
433ed471ceca49f696ba72856894860594a5dccbcac82da61797ae7a3a3ebfef
Tree hash
efb3a5c2872f1f029609b8b1b25768a3862f787750acdbbc6626ac4a262e5cae
Skill path
skills/101-skills/agent-browser
Audit payload hash
1658c35f2c56ecd45ce24d5ac0658162

Analysis metadata

Audit model: claude

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active