Versioned security assessment

Report ID: SA-A25199BC

7/5/2026, 5:15:36 PM

agent-browser security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
agent-browser
Version
v3
Maintainer
inference-sh-0
Source
github.com/inference-sh-0/skills/tree/main/skills/agentic-browser/
Coverage
9 Files scanned · 2,105 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

6 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill provides useful browser automation, but it relies on shell-driven infsh workflows, remote browser capture, proxy support, file upload, and page JavaScript execution. The critical issue is the pipe-to-shell installer; additional high-risk content includes cookie extraction guidance and proxy rotation for rate-limit avoidance. No prompt injection attempt was found in the reviewed files.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

9 Files scanned · 2,105 Lines analyzed

90 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 54 evidence locations

Filesystem access

May read or write local files.

Observed in 15 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 157 evidence locations

Capability review items (84)
High
references/authentication.md:215-217
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION --input '{
The authentication guide shows extracting and printing cookie-related browser data from an authenticated session. That can expose session secrets outside the browser context.
High
references/authentication.md:218
Shell command substitution
COOKIES=$(echo $RESULT | jq -r '.result')
The authentication guide shows extracting and printing cookie-related browser data from an authenticated session. That can expose session secrets outside the browser context.
High
references/authentication.md:222-223
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION --input '{
The authentication guide shows extracting and printing cookie-related browser data from an authenticated session. That can expose session secrets outside the browser context.
High
references/proxy-support.md:152
SOCKS proxy
"proxy_url": "socks5://privacy-proxy.example.com:1080"
The proxy documentation explicitly supports SOCKS proxy routing. This can hide traffic origin and is paired with scraping and anonymity workflows in the same reference.
High
references/proxy-support.md:165
SOCKS proxy
### SOCKS5 Proxy
The proxy documentation explicitly supports SOCKS proxy routing. This can hide traffic origin and is paired with scraping and anonymity workflows in the same reference.
High
references/proxy-support.md:168
SOCKS proxy
{"proxy_url": "socks5://proxy.example.com:1080"}
The proxy documentation explicitly supports SOCKS proxy routing. This can hide traffic origin and is paired with scraping and anonymity workflows in the same reference.
High
SKILL.md:17
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh && infsh login
The URL is used to download the CLI installer that is piped into a shell. This is a real network trust and code execution risk.
Medium
references/authentication.md:24-26
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/authentication.md:51
Shell command substitution
RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION --input '{}')
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/authentication.md:52
Shell command substitution
URL=$(echo $RESULT | jq -r '.url')
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/authentication.md:70-72
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/authentication.md:80
Shell command substitution
RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION --input '{}')
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/authentication.md:97
Shell command substitution
RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION --input '{}')
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/authentication.md:115
Shell command substitution
RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION --input '{}')
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/authentication.md:116
Shell command substitution
URL=$(echo $RESULT | jq -r '.url')
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/authentication.md:128
Shell command substitution
RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION --input '{}')
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/authentication.md:129
Shell command substitution
ELEMENTS=$(echo $RESULT | jq -r '.elements_text')
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/authentication.md:133
Shell command substitution
TOTP_CODE=$(oathtool --totp -b "$TOTP_SECRET")
The example invokes oathtool with a TOTP secret during automated login. This is legitimate but processes authentication secrets through shell commands.
Medium
references/authentication.md:153-156
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/authentication.md:179-181
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/authentication.md:202
Shell command substitution
SESSION=$(login)
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/authentication.md:243
Shell command substitution
export PASSWORD=$(cat /path/to/secure/password)
The example reads passwords from local files or a secrets manager into shell environment variables. This is legitimate guidance but still handles sensitive credentials in shell state.
Medium
references/authentication.md:246
Shell command substitution
export PASSWORD=$(vault read -field=password secret/app)
The example reads passwords from local files or a secrets manager into shell environment variables. This is legitimate guidance but still handles sensitive credentials in shell state.
Medium
references/authentication.md:285
Shell command substitution
URL=$(echo $RESULT | jq -r '.url')
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/authentication.md:292
Shell command substitution
ELEMENTS=$(echo $RESULT | jq -r '.elements_text')
The finding is a shell command substitution in skill-provided instructions. Legitimate use is possible, but the pattern executes commands and is kept fail-closed.
Medium
references/proxy-support.md:22-25
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The proxy reference includes executable shell examples that run infsh through proxy settings. This is intended functionality, but it enables external network automation through a shell workflow.
Medium
references/proxy-support.md:35-40
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The proxy reference includes executable shell examples that run infsh through proxy settings. This is intended functionality, but it enables external network automation through a shell workflow.
Medium
references/proxy-support.md:65-68
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The proxy reference includes executable shell examples that run infsh through proxy settings. This is intended functionality, but it enables external network automation through a shell workflow.
Medium
references/proxy-support.md:76
Shell command substitution
RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION --input '{}')
The proxy reference includes executable shell examples that run infsh through proxy settings. This is intended functionality, but it enables external network automation through a shell workflow.
Medium
references/proxy-support.md:113-116
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The proxy reference includes executable shell examples that run infsh through proxy settings. This is intended functionality, but it enables external network automation through a shell workflow.
Medium
references/proxy-support.md:119-121
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION --input '{
The proxy reference includes executable shell examples that run infsh through proxy settings. This is intended functionality, but it enables external network automation through a shell workflow.
Medium
references/proxy-support.md:137-142
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The proxy reference includes executable shell examples that run infsh through proxy settings. This is intended functionality, but it enables external network automation through a shell workflow.
Medium
references/proxy-support.md:150-153
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The proxy reference includes executable shell examples that run infsh through proxy settings. This is intended functionality, but it enables external network automation through a shell workflow.
Medium
references/proxy-support.md:186-189
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The proxy reference includes executable shell examples that run infsh through proxy settings. This is intended functionality, but it enables external network automation through a shell workflow.
Medium
references/proxy-support.md:192-194
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION --input '{
The proxy reference includes executable shell examples that run infsh through proxy settings. This is intended functionality, but it enables external network automation through a shell workflow.
Medium
references/proxy-support.md:195
Shell command substitution
echo "IP via proxy: $(echo $RESULT | jq -r '.result')"
The proxy reference includes executable shell examples that run infsh through proxy settings. This is intended functionality, but it enables external network automation through a shell workflow.
Medium
references/proxy-support.md:267-270
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The proxy reference includes executable shell examples that run infsh through proxy settings. This is intended functionality, but it enables external network automation through a shell workflow.
Medium
references/proxy-support.md:273
Shell command substitution
SESSION_ID=$(echo $SESSION | jq -r '.session_id')
The proxy reference includes executable shell examples that run infsh through proxy settings. This is intended functionality, but it enables external network automation through a shell workflow.
Medium
references/snapshot-refs.md:124-126
Shell command substitution
RESULT=$(infsh app run agent-browser --function interact --session $SESSION --input '{
The documentation shows command substitution around infsh interaction examples. It is intended usage but still executes an external browser automation CLI.
Medium
references/snapshot-refs.md:136-138
Shell command substitution
RESULT=$(infsh app run agent-browser --function interact --session $SESSION --input '{
The documentation shows command substitution around infsh interaction examples. It is intended usage but still executes an external browser automation CLI.
Medium
references/video-recording.md:23-26
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:38
Shell command substitution
RESULT=$(infsh app run agent-browser --function close --session $SESSION --input '{}')
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:39
Shell command substitution
VIDEO=$(echo $RESULT | jq -r '.video')
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:48-52
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:87-90
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:93-95
Shell command substitution
RESULT=$(infsh app run agent-browser --function interact --session $SESSION --input '{
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:97
Shell command substitution
SUCCESS=$(echo $RESULT | jq -r '.success')
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:100
Shell command substitution
echo "Message: $(echo $RESULT | jq -r '.message')"
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:103
Shell command substitution
CLOSE_RESULT=$(infsh app run agent-browser --function close --session $SESSION --input '{}')
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:104
Shell command substitution
echo "Debug video: $(echo $CLOSE_RESULT | jq -r '.video')"
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:119-124
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:156
Shell command substitution
RESULT=$(infsh app run agent-browser --function close --session $SESSION --input '{}')
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:157
Shell command substitution
echo "Documentation video: $(echo $RESULT | jq -r '.video')"
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:168-171
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:178
Shell command substitution
CLOSE_RESULT=$(infsh app run agent-browser --function close --session $SESSION --input '{}')
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:179
Shell command substitution
VIDEO=$(echo $CLOSE_RESULT | jq -r '.video')
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:195
Shell command substitution
TASK_ID=$(date +%Y%m%d-%H%M%S)
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:197-200
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:206
Shell command substitution
RESULT=$(infsh app run agent-browser --function close --session $SESSION --input '{}')
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
references/video-recording.md:207
Shell command substitution
VIDEO=$(echo $RESULT | jq -r '.video')
The video reference includes executable shell examples that start browser sessions and collect recording output. These workflows can capture sensitive page activity if run on private sessions.
Medium
SKILL.md:34-36
Shell command substitution
RESULT=$(infsh app run agent-browser --function open --session new --input '{
The main skill instructions include executable Bash examples using command substitution with infsh. This is intended usage but still asks agents or users to run external commands.
Medium
SKILL.md:37
Shell command substitution
SESSION_ID=$(echo $RESULT | jq -r '.session_id')
The main skill instructions include executable Bash examples using command substitution with infsh. This is intended usage but still asks agents or users to run external commands.
Medium
SKILL.md:114-118
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The main skill instructions include executable Bash examples using command substitution with infsh. This is intended usage but still asks agents or users to run external commands.
Medium
SKILL.md:213-215
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The main skill instructions include executable Bash examples using command substitution with infsh. This is intended usage but still asks agents or users to run external commands.
Medium
SKILL.md:231-233
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The main skill instructions include executable Bash examples using command substitution with infsh. This is intended usage but still asks agents or users to run external commands.
Medium
SKILL.md:246-249
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
The main skill instructions include executable Bash examples using command substitution with infsh. This is intended usage but still asks agents or users to run external commands.
Medium
SKILL.md:257
Shell command substitution
RESULT=$(infsh app run agent-browser --function close --session $SESSION --input '{}')
The main skill instructions include executable Bash examples using command substitution with infsh. This is intended usage but still asks agents or users to run external commands.
Medium
templates/authenticated-session.sh:40-42
Shell command substitution
RESULT=$(infsh app run agent-browser --function open --session new --input '{
This is active template code that runs infsh or parses its output through shell command substitution. The template can browse user-supplied URLs through a network-backed CLI.
Medium
templates/authenticated-session.sh:43
Shell command substitution
SESSION_ID=$(echo $RESULT | jq -r '.session_id')
This is active template code that runs infsh or parses its output through shell command substitution. The template can browse user-supplied URLs through a network-backed CLI.
Medium
templates/authenticated-session.sh:1
Unix shell invocation
#!/bin/bash
This is an executable Bash template shipped with the skill. The script invokes the infsh browser automation CLI and can act on user-provided web targets.
Medium
templates/capture-workflow.sh:28
Shell command substitution
CLOSE_RESULT=$(infsh app run agent-browser --function close --session $SESSION_ID --input '{}' 2>/de
This is active template code that runs infsh or parses its output through shell command substitution. The template can browse user-supplied URLs through a network-backed CLI.
Medium
templates/capture-workflow.sh:31
Shell command substitution
VIDEO=$(echo $CLOSE_RESULT | jq -r '.video // empty')
This is active template code that runs infsh or parses its output through shell command substitution. The template can browse user-supplied URLs through a network-backed CLI.
Medium
templates/capture-workflow.sh:54-59
Shell command substitution
RESULT=$(infsh app run agent-browser --function open --session new --input '{
This is active template code that runs infsh or parses its output through shell command substitution. The template can browse user-supplied URLs through a network-backed CLI.
Medium
templates/capture-workflow.sh:60
Shell command substitution
SESSION_ID=$(echo $RESULT | jq -r '.session_id')
This is active template code that runs infsh or parses its output through shell command substitution. The template can browse user-supplied URLs through a network-backed CLI.
Medium
templates/capture-workflow.sh:63
Shell command substitution
URL=$(echo $RESULT | jq -r '.url')
This is active template code that runs infsh or parses its output through shell command substitution. The template can browse user-supplied URLs through a network-backed CLI.
Medium
templates/capture-workflow.sh:64
Shell command substitution
TITLE=$(echo $RESULT | jq -r '.title')
This is active template code that runs infsh or parses its output through shell command substitution. The template can browse user-supplied URLs through a network-backed CLI.
Medium
templates/capture-workflow.sh:86
Shell command substitution
RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')
This is active template code that runs infsh or parses its output through shell command substitution. The template can browse user-supplied URLs through a network-backed CLI.
Medium
templates/capture-workflow.sh:105-107
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{
This is active template code that runs infsh or parses its output through shell command substitution. The template can browse user-supplied URLs through a network-backed CLI.
Medium
templates/capture-workflow.sh:114-115
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{
This is active template code that runs infsh or parses its output through shell command substitution. The template can browse user-supplied URLs through a network-backed CLI.
Medium
templates/capture-workflow.sh:1
Unix shell invocation
#!/bin/bash
This is an executable Bash template shipped with the skill. The script invokes the infsh browser automation CLI and can act on user-provided web targets.
Medium
templates/form-automation.sh:30-32
Shell command substitution
RESULT=$(infsh app run agent-browser --function open --session new --input '{
This is active template code that runs infsh or parses its output through shell command substitution. The template can browse user-supplied URLs through a network-backed CLI.
Medium
templates/form-automation.sh:33
Shell command substitution
SESSION_ID=$(echo $RESULT | jq -r '.session_id')
This is active template code that runs infsh or parses its output through shell command substitution. The template can browse user-supplied URLs through a network-backed CLI.
Medium
templates/form-automation.sh:1
Unix shell invocation
#!/bin/bash
This is an executable Bash template shipped with the skill. The script invokes the infsh browser automation CLI and can act on user-provided web targets.
Low
SKILL.md:11
Hardcoded URL
![Agentic Browser](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgjw8atdxgkrs
The Markdown loads a remote image from cloud.inference.sh. This is low severity, but it can create an external request when rendered.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (6)

RISK-001 Critical
SKILL.md:17
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh && infsh login
The quick start pipes a remote installer from cli.inference.sh directly into sh. This can execute unverified network content on the user machine.
RISK-002 High
SKILL.md:3
Screen capture upload
description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e
The skill description advertises screenshots and video recording for browser sessions. Captures can include credentials or private page content and may be returned through the external service.
RISK-003 High
references/authentication.md:209-224
Cookie Extraction Guidance
The authentication reference shows extracting browser cookies and printing them after an authenticated session. This can expose session tokens or private account data outside the browser.
The section title and examples directly describe cookie extraction from an authenticated browser session. The risk is clear even though the code is presented as documentation.
RISK-004 High
references/proxy-support.md:85-129
Rate Limit Evasion via Proxy Rotation
The proxy guide includes a rate-limit avoidance workflow that rotates proxies for scraping. This supports evasion of site controls and can enable abusive automation.
The heading and example explicitly connect proxy rotation with rate-limit avoidance. This is strong intent-level evidence beyond generic proxy support.
RISK-005 High
SKILL.md:154-163
Local File Upload Capability
The skill supports uploading local file paths into browser file inputs. Without explicit user review, an agent could disclose local files to an external website.
The documented upload action accepts file paths and sends them through a browser form. The capability is legitimate but has a clear data disclosure risk.
RISK-006 Medium
SKILL.md:178-185references/commands.md:162-176
Arbitrary Page JavaScript Execution
The skill exposes an execute function for running custom JavaScript in the current page. This can extract page data or alter page state during authenticated sessions.
The function is documented as accepting custom JavaScript code. The browser context makes the risk concrete, but it is also an intended automation feature.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote installer is piped directly into a shell.
    Replace the curl-to-shell quick start with a signed release download, checksum verification, and separate install command.
  2. FIX-002
    High
    Authenticated session guidance includes cookie extraction and sensitive capture workflows.
    Remove cookie extraction examples and require explicit consent before screenshots, videos, file uploads, or JavaScript on authenticated pages.
  3. FIX-003
    High
    Proxy documentation includes rate-limit avoidance and anonymity use cases.
    Limit proxy examples to legitimate geo-testing and corporate access, and remove evasion-oriented scraping examples.
  4. FIX-004
    Medium
    Shell templates interpolate user input into command-line JSON payloads.
    Build JSON payloads with a structured encoder, validate target URLs, and quote session identifiers consistently.
  5. FIX-005
    Medium
    Arbitrary JavaScript execution and local file upload are broad browser capabilities.
    Add clear approval gates and warnings before executing page JavaScript or uploading local files to external websites.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable