Versioned security assessment

Report ID: SA-F38CA0D4

6/30/2026, 4:30:09 AM

agent-browser security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
agent-browser
Version
v2
Maintainer
inference-sh-0
Source
github.com/inference-sh-0/skills/tree/main/skills/agentic-browser/
Coverage
9 Files scanned · 2,105 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

5 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis found many shell, network, filesystem, and credential-related patterns. Review shows most shell and URL matches are documentation examples or user-run templates, but the skill intentionally enables powerful browser automation with authenticated sessions, screenshots, video, proxies, file upload, and page JavaScript execution. No prompt injection or confirmed malicious exfiltration was found, so this is publishable only with clear warnings about sensitive browsing and credential use.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

9 Files scanned · 2,105 Lines analyzed

5 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 3 evidence locations

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 4 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 4 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (5)

RISK-001 Medium
SKILL.md:3-4references/commands.md:74-113references/commands.md:162-176
Powerful Remote Browser Automation
The skill grants an AI workflow the ability to open arbitrary URLs, click controls, fill fields, upload files, take screenshots, and execute page JavaScript through the inference.sh browser service. This is expected for the skill, but it can affect real accounts and sensitive web pages if used without user review.
The advertised capabilities and command reference directly confirm broad browser control. The behavior is disclosed, so this is dual-use risk rather than hidden malicious behavior.
RISK-002 Medium
references/authentication.md:99-102references/authentication.md:213-219templates/authenticated-session.sh:66-84
Credential and Cookie Handling Guidance
The authentication documentation shows login automation using password variables and a cookie extraction workflow using document.cookie. These examples can support legitimate testing, but they can expose session data when used on sensitive accounts.
The file explicitly describes credential filling and cookie extraction. The surrounding documentation also includes safety advice, which lowers confidence of malicious intent.
RISK-003 Medium
references/proxy-support.md:30-40references/proxy-support.md:85-115references/proxy-support.md:145-168
Proxy Rotation and Anonymity Support
The proxy guide includes authenticated proxies, SOCKS5 proxy use, privacy routing, and a rate-limit avoidance example. Proxy support is legitimate for geo-testing and corporate networks, but rate-limit avoidance is a dual-use scraping pattern.
The documentation directly names rate-limit avoidance and SOCKS proxy routing. Legitimate examples are also present, so the risk is contextual.
RISK-004 Medium
SKILL.md:108-118references/commands.md:136-158templates/capture-workflow.sh:89-109references/video-recording.md:260-272
Screenshots, Video, and Local Capture Outputs
The skill can capture screenshots and full session video, and templates save page text, links, screenshots, and video metadata to local files. This can leak sensitive page contents when used on authenticated or private sites.
The capture and recording behavior is clearly documented. The video reference warns against sensitive sessions, reducing concern about malicious intent.
RISK-005 Medium
SKILL.md:154-163references/commands.md:87-113
Local File Upload Capability
The interact action accepts file_paths and the main guide shows uploading a local file path to a web form. This is useful for test automation, but it can disclose local files if a user authorizes unsafe prompts.
The upload action and file_paths field are explicit. The evidence does not show automatic file selection or stealth upload.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (3)
Low
SKILL.md:32-37templates/form-automation.sh:30-33templates/capture-workflow.sh:54-60
Shell Pattern Flood Is Mostly Documentation and Templates
The many shell command and command substitution alerts primarily come from bash examples and reusable scripts that invoke infsh and jq. The skill metadata restricts allowed Bash usage to infsh commands, but the templates still require normal shell caution when copied and run.
The matched patterns are visible shell examples, not hidden runtime code in an application package. Some risk remains because users may execute the templates locally.
Low
SKILL.md:9-20references/commands.md:23-34references/proxy-support.md:93-103
Hardcoded URL Matches Are Mostly Examples
Hardcoded URL alerts point to inference.sh documentation, example.com, Google, httpbin, and proxy placeholders. I found no evidence that the skill silently sends collected data to an unrelated endpoint.
The URLs are examples or the declared inference.sh service. No suspicious destination or concealed network exfiltration was found in the reviewed files.
Low
references/commands.md:37-45references/commands.md:85-97references/snapshot-refs.md:52-60
Weak Cryptography Alerts Appear to Be False Positives
The static weak-crypto blocker hits align with markdown tables, password field names, and example content rather than cryptographic functions. No evidence found of MD5, SHA1, custom encryption, or password hashing logic in the reviewed skill files.
The cited locations contain documentation structure and field names, not crypto implementation. Confidence is not 1.0 because the static list is broad, but sampled evidence supports dismissal.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable