Skills browser-use

📦

browser-use

Name: browser-use
Author: AbdullahMalik17

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Automate Browser Workflows with Playwright MCP

Manual browser workflows are slow and hard to repeat. This skill provides Playwright MCP commands for navigation, forms, screenshots, and extraction.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "browser-use" from https://skillstore.io/skills/abdullahmalik17-browser-use.md and its manifest at https://skillstore.io/api/skills/abdullahmalik17-browser-use/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/abdullahmalik17-browser-use.md Signed manifest GET /api/skills/abdullahmalik17-browser-use/manifest Signed lockfile GET /api/skills/abdullahmalik17-browser-use/lockfile

Test it

Using "browser-use". Open a product page and capture a full-page screenshot.

Expected outcome:

The browser opened the product page, captured a full-page screenshot, and reported the main headings and visible calls to action.

Using "browser-use". Submit a demo contact form after I approve the filled fields.

Expected outcome:

The form fields were filled, approval was requested before submission, and a confirmation screenshot was captured after submit.

Using "browser-use". Extract visible article titles from a news category page.

Expected outcome:

Returned a concise list of visible article titles, source section names, and notes about pagination.

Security Audit

High Risk

v9 • 7/7/2026 Open versioned report

Most static hits in the generated reference documentation are false positives from Markdown backticks and JSON Schema URLs. Confirmed risks remain in the stdio subprocess path, shell lifecycle helpers, HTTP-capable MCP client requests, predictable /tmp PID files, and browser JavaScript execution guidance. No prompt injection text was found in the reviewed files.

Files scanned

1,533

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:98-109 references/playwright-tools.md:452-471

Arbitrary Browser JavaScript Execution

The skill documents browser_evaluate and browser_run_code for caller-supplied JavaScript and Playwright code. In an authenticated browser, this can read page content or perform unintended actions.

The referenced lines explicitly document executing supplied browser JavaScript or Playwright code. The risk depends on target page context, but the capability is direct and powerful.

Medium

SKILL.md:36 scripts/start-server.sh:15

Persistent Shared Browser Context

The skill requires shared browser context across MCP calls. This can retain cookies, logged-in state, and other session data longer than users expect.

The instructions state that shared browser context is required, and the start script enables it. Persistent state is intentional, but it is security-sensitive for authenticated sessions.

Capability review items (21)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/mcp-client.py:204

Python subprocess.Popen

self._process = subprocess.Popen(

subprocess.Popen is called with shell=True on the caller-provided --stdio command. This can execute arbitrary shell syntax if untrusted input reaches that option.

High

SKILL.md:98-101

Ruby/shell backtick execution

```bash

The range documents browser_evaluate with caller-supplied JavaScript. In an active browser context, JavaScript can inspect or manipulate page state.

High

SKILL.md:105-107

Ruby/shell backtick execution

For complex workflows, use `browser_run_code` to run multiple actions in one call:

The prose recommends browser_run_code for complex multi-step browser workflows. That tool runs supplied Playwright code and can perform powerful page actions.

High

SKILL.md:107-110

Ruby/shell backtick execution

```bash

The range shows browser_run_code executing supplied Playwright code through the MCP client. This can perform arbitrary browser actions in the current page context.

Medium

scripts/start-server.sh:1

Unix shell invocation

#!/bin/bash

This shell helper starts the Playwright MCP server through npx in the same script. It intentionally launches local processes and pulls an external package name.

Medium

scripts/start-server.sh:6

Temp directory access

PID_FILE="/tmp/playwright-mcp-${PORT}.pid"

The script stores the server PID in a predictable /tmp path derived from the port. A local user could tamper with that file and affect lifecycle checks.

Medium

scripts/stop-server.sh:12

Shell command substitution

python3 "$(dirname "$0")/mcp-client.py" call -u "http://localhost:${PORT}" -t browser_close -p '{}'

The line invokes python3 to run the bundled MCP client before stopping the server. The dirname substitution is quoted, but this is still intentional external command execution.

Medium

scripts/stop-server.sh:1

Unix shell invocation

#!/bin/bash

This shell helper controls processes with kill and pkill in the same script. It is intended lifecycle management, but it is security relevant process control.

Medium

scripts/stop-server.sh:6

Temp directory access

PID_FILE="/tmp/playwright-mcp-${PORT}.pid"

The stop script trusts a predictable /tmp PID file to choose which process to signal. A tampered PID file could cause it to target an unintended process.

Medium

SKILL.md:13-19

Ruby/shell backtick execution

```bash

This Markdown range instructs users or agents to run bash scripts and npx @playwright/mcp@latest. These are real local shell commands, even though the static pattern name is imprecise.

Medium

SKILL.md:22-29

Ruby/shell backtick execution

```bash

This Markdown range instructs stopping the server with bash, python3, and pkill commands. Those commands intentionally execute local processes and signal matching processes.

Medium

SKILL.md:42-49

Ruby/shell backtick execution

```bash

The range contains shell examples that call scripts/mcp-client.py for browser navigation. This is intended tooling, but it directs agents to execute local commands.

Medium

SKILL.md:53-60

Ruby/shell backtick execution

```bash

The range contains shell examples that call the MCP client for snapshots and screenshots. It is legitimate documentation, but it still asks the agent to run local commands.

Medium

SKILL.md:66-82

Ruby/shell backtick execution

```bash

The range contains shell commands for clicking, typing, filling forms, and selecting options. These commands can change live web pages and submit user data.

Medium

SKILL.md:86-94

Ruby/shell backtick execution

```bash

The range contains shell examples that invoke the MCP client for wait operations. The action is low impact, but it still directs local command execution.

Low

scripts/mcp-client.py:146

HTTP client library

def request(self, method: str, params: Optional[dict] = None) -> dict:

This request method builds and sends JSON-RPC calls through the HTTP transport. The destination is caller-controlled through --url, so the network capability is real.

Low

scripts/mcp-client.py:314

HTTP client library

result = self.transport.request("tools/list")

The high-level client sends a tools/list request through the selected transport. When HTTP transport is selected, this is outbound network activity to a caller-provided MCP server.

Low

scripts/mcp-client.py:323

HTTP client library

result = self.transport.request("tools/call", params)

The high-level client sends tools/call parameters through the selected transport. With HTTP transport, tool names and arguments are sent to the configured MCP endpoint.

Low

scripts/mcp-client.py:328

HTTP client library

result = self.transport.request("resources/list")

The resource listing request is routed through the selected MCP transport. If HTTP is used, the request goes to the caller-provided server URL.

Low

scripts/mcp-client.py:333

HTTP client library

result = self.transport.request("prompts/list")

The prompt listing request is routed through the selected MCP transport. If HTTP is used, the request goes to the caller-provided server URL.

Low

scripts/mcp-client.py:33

Python HTTP libraries

from urllib.request import Request, urlopen

The client imports urllib.request and uses it for MCP HTTP transport. Network access is intended, but it is still a real capability that can contact caller-provided URLs.

Risk Factors

⚙️ External commands (37)

🌐 Network access (49)

📁 Filesystem access (9)

scripts/start-server.sh:9 scripts/start-server.sh:20 scripts/start-server.sh:6 scripts/stop-server.sh:10 scripts/stop-server.sh:12 scripts/stop-server.sh:15 scripts/stop-server.sh:19 scripts/stop-server.sh:28 scripts/stop-server.sh:6

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/abdullahmalik17-browser-use/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/abdullahmalik17-browser-use/security.svg)](https://skillstore.io/skills/abdullahmalik17-browser-use?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/abdullahmalik17-browser-use?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/abdullahmalik17-browser-use/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/abdullahmalik17-browser-use.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AbdullahMalik17. (2026). browser-use security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/abdullahmalik17-browser-use/audits/9

BibTeX citation

@techreport{abdullahmalik17-abdullahmalik17-browser-use-2026,
  author = {AbdullahMalik17},
  title = {browser-use security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/abdullahmalik17-browser-use/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "browser-use security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "AbdullahMalik17"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/abdullahmalik17-browser-use/audits/9"
identifiers:
  - type: other
    value: "skillstore:abdullahmalik17-browser-use:audit:9"
    description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Stronger evidence confidence

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

browser-use Recommended

browser-use-browser-use

Skillstore Score 38

Evidence Confidence High

Skillstore usage 69

Updated

2026-08-21

92Bilal26

92bilal26-browser-use

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 53

Updated

2026-08-21

AbdullahMalik17 Current

abdullahmalik17-browser-use

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Test Web Workflows

Validate login, search, checkout, and regression flows with repeatable browser actions.

Collect Public Page Data

Collect public page snapshots, screenshots, and visible structured data for analysis.

Debug Web Applications

Inspect UI states, console messages, and network activity during debugging.

Try These Prompts

Open a Page

Start the Playwright MCP server, open [URL], capture a snapshot, and summarize the visible page state.

Fill a Form

Open [URL], get a snapshot, fill these fields: [fields], submit only after confirmation, and capture a screenshot.

Extract Visible Data

Visit [URL], collect the visible data matching [criteria], note pagination, and return concise findings with source page names.

Run a Multi-Step Workflow

Use browser_run_code only for this approved workflow: [steps]. Avoid sensitive fields, record each page reached, and stop the server when complete.

Best Practices

Run browser_snapshot before clicking or typing so element references are current.
Use approved domains and staging environments for tests that submit forms.
Stop the MCP server and clear browser state after sensitive work.

Avoid

Do not browse authenticated accounts or submit credentials without explicit user approval.
Do not pass untrusted text into the stdio command option.
Do not use browser_run_code when a named browser tool can complete the task.