Versioned security assessment

Report ID: SA-185ED340

6/30/2026, 3:49:54 AM

agent-browser security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
agent-browser
Version
v2
Maintainer
inference-sh-8
Source
github.com/inference-sh-8/skills/tree/main/skills/agentic-browser/
Coverage
9 Files scanned · 2,107 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis found many command, network, filesystem, and credential patterns. Most Markdown backtick and hardcoded URL hits are documentation examples, but the skill still exposes high-risk browser automation capabilities, including a remote shell installer, authenticated workflows, cookie extraction, JavaScript execution, screenshots, video, file upload, and proxy routing. No prompt injection or confirmed malicious intent was found, so this is not blocked, but it should not publish without strong warnings and review.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

9 Files scanned · 2,107 Lines analyzed

7 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 3 evidence locations

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 3 evidence locations

Capability review items (6)
High
SKILL.md:15-23
Remote Installer Piped To Shell
The quick start instructs users to download a remote script and pipe it directly to sh before login. This is a supply-chain risk because the fetched installer executes immediately if the endpoint, TLS path, or script is compromised. The later checksum note reduces risk but does not protect the pipe-to-shell command itself.
The pipe-to-shell command is explicit on SKILL.md line 17. The surrounding install note confirms this is an intended installation path, not a scanner artifact.
High
references/commands.md:21-49references/commands.md:87-97references/commands.md:162-176
Combined Browser Control, Network Access, And Page Execution
The skill can navigate arbitrary URLs, interact with forms, capture screenshots, upload files, and execute page JavaScript through the inference.sh CLI. This combination can collect or submit sensitive data if used on private or authenticated sites.
The command reference clearly lists URL navigation, proxy credentials, file upload paths, and arbitrary page JavaScript. These are expected features but form a high-risk capability set.
Medium
references/proxy-support.md:149-168
Proxy Routing Can Bypass Network Assumptions
The proxy documentation supports HTTP, HTTPS, and SOCKS5 routing. Proxy support is useful for testing, but it can hide traffic origin, bypass regional controls, or route sensitive sessions through untrusted infrastructure.
SOCKS5 and other proxy examples are explicitly documented. The risk depends on user configuration, so this is a medium concern rather than confirmed abuse.
Medium
templates/capture-workflow.sh:89-116references/video-recording.md:21-31
Screenshots, Video, And Extracted Page Data Saved To Files
The capture workflow saves screenshots, element text, body text, links, and optional video files. This is useful for audits and research, but it can persist private page contents on disk if used with sensitive pages.
The template writes captured browser outputs to local files and the video guide enables session recording. The data sensitivity depends on the target website.
Medium
templates/authenticated-session.sh:22-43templates/capture-workflow.sh:52-60templates/form-automation.sh:17-33
Shell Templates Execute External CLI Commands With User Input
The shell templates pass user-supplied URLs and output paths into infsh commands. The scripts use strict shell settings and quote key variables, but they still run external browser automation based on user input.
The scripts clearly run infsh with user-provided URLs. Quoting and use of a single CLI reduce command-injection evidence, so the remaining concern is controlled external execution.
Low
SKILL.md:17-23
SHA-256 Mention Misclassified As Weak Cryptography
The weak cryptography findings include documentation about SHA-256 checksum verification. SHA-256 checksums are not a weak algorithm in this context, although checksums do not remove the risk of piping an installer to a shell.
The cited text describes checksum verification for a CLI installer. This is not evidence of weak cryptographic use in skill code.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 High
SKILL.md:42-48templates/authenticated-session.sh:66-84references/authentication.md:213-224
Credential And Cookie Exposure Workflows
The skill documents login automation, credential filling, and cookie extraction. This is legitimate for browser automation, but it creates a high risk of exposing session cookies, usernames, passwords, or authenticated page data through command output, screenshots, files, or downstream tools.
The documentation explicitly fills password fields and prints cookies extracted with JavaScript. The behavior is user-directed, but the sensitive-data exposure risk is direct.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
Low
references/commands.md:7-15SKILL.md:34-39
Markdown Backticks Misclassified As Ruby Execution
Many static external-command findings come from Markdown code fences and inline command examples. These are instructional examples rather than hidden Ruby backtick execution in application code.
The cited lines are Markdown command examples and fenced documentation. No Ruby source file or runtime backtick execution was found in those locations.
Low
references/commands.md:1-3references/snapshot-refs.md:1-5
Relative Documentation Links Misclassified As Path Traversal
The path traversal findings point to relative Markdown links such as ../SKILL.md. These links navigate documentation and do not read arbitrary filesystem paths at runtime.
The evidence is documentation linking to another file in the skill package. There is no path concatenation or filesystem access in these Markdown links.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable