Versioned security assessment

Report ID: SA-A0668140

7/6/2026, 3:12:34 PM

agent-browser security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
agent-browser
Version
v4
Maintainer
inference-sh-8
Source
github.com/inference-sh-8/skills/tree/main/skills/agentic-browser/
Coverage
9 Files scanned · 2,107 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

5 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are false positives from Markdown syntax, visible shell examples, placeholder URLs, relative documentation links, and /dev/null redirection. Confirmed risks include the remote installer piped to shell, advertised screen capture and file upload capabilities, SOCKS proxy support, cookie extraction guidance, proxy-based rate limit avoidance, and automated authentication handling.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

9 Files scanned · 2,107 Lines analyzed

9 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 55 evidence locations

Filesystem access

May read or write local files.

Observed in 15 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 158 evidence locations

Capability review items (4)
Critical
SKILL.md:17
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh && infsh login
The URL is fetched by curl in the same command that pipes its output to sh. The hardcoded endpoint is therefore part of a remote execution path.
High
references/proxy-support.md:152
SOCKS proxy
"proxy_url": "socks5://privacy-proxy.example.com:1080"
The proxy documentation explicitly supports SOCKS5 routing for browser sessions. This can anonymize automation traffic and help bypass network controls.
High
references/proxy-support.md:165
SOCKS proxy
### SOCKS5 Proxy
The proxy documentation explicitly supports SOCKS5 routing for browser sessions. This can anonymize automation traffic and help bypass network controls.
High
references/proxy-support.md:168
SOCKS proxy
{"proxy_url": "socks5://proxy.example.com:1080"}
The proxy documentation explicitly supports SOCKS5 routing for browser sessions. This can anonymize automation traffic and help bypass network controls.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (5)

RISK-001 Critical
SKILL.md:17
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh && infsh login
The quick start pipes a remote installer from cli.inference.sh directly into sh. This creates remote code execution and supply-chain risk if the endpoint or transport is compromised.
RISK-002 High
SKILL.md:3
Screen capture upload
description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e
The skill description advertises screenshots, video recording, and file upload. These capabilities can capture sensitive page content or transmit local files when invoked.
RISK-003 High
references/authentication.md:209-224
Cookie Extraction Guidance
The authentication guide includes a section titled Cookie Extraction and shows extracting document.cookie for use in other tools. This can expose session tokens and enable account takeover if copied into real workflows.
The file explicitly labels the workflow as cookie extraction and shows collecting cookies from an authenticated browser session.
RISK-004 High
references/proxy-support.md:85-128
Proxy Rotation for Rate Limit Avoidance
The proxy guide has a Rate Limit Avoidance section that rotates proxies while scraping pages. This encourages bypassing target service limits and can support abusive collection.
The section title and sample loop directly connect proxy rotation with avoiding rate limits during scraping.
RISK-005 Medium
references/authentication.md:63-145
Automated Authentication and 2FA Handling
The authentication guide automates OAuth, password entry, TOTP generation, and manual 2FA entry. This is useful for testing but dangerous without strong authorization boundaries.
The guidance clearly covers login automation and TOTP generation, but legitimate internal testing use is possible.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote installer is piped directly to sh in the quick start.
    Replace it with reviewed package manager instructions or a download-and-verify flow that users run after inspecting the installer.
  2. FIX-002
    High
    Documentation shows extracting cookies from authenticated sessions.
    Remove cookie extraction examples or restrict them to owned test systems with redaction and no logging of session data.
  3. FIX-003
    High
    Proxy documentation promotes rate limit avoidance.
    Remove bypass language and frame proxy use around authorized geo-testing, corporate access, and compliance with target site limits.
  4. FIX-004
    High
    Screenshots, videos, and file uploads can expose sensitive data.
    Add consent, redaction, and data handling warnings before capture, recording, and upload workflows.
  5. FIX-005
    Medium
    Authentication examples include OAuth, credentials, and TOTP automation.
    Limit examples to test accounts, avoid MFA bypass framing, and require authorized use with secrets kept out of logs.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
a06681402992ceae98ba04d54cfd4ab004862696
Content hash
d5dbc1ef6fea6f5b5e66bcfcb3943c30c9c7239b81b7860219de35309e597def
Tree hash
0c963aa80fa50c129bb47c26b66947468d832d4f995f69244e86961d24806b31
Skill path
skills/inference-sh-8/agent-browser
Audit payload hash
6eedd7160b85f0fd1b994bba75c115da

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable