Skills agent-browser
📦
agent-browser
Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Automate Browser Workflows
Browser tasks often require repeated clicks, forms, screenshots, and page inspection. This skill gives Claude, Codex, and Claude Code a reusable browser automation workflow through inference.sh.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "agent-browser" from https://skillstore.io/skills/inference-sh-9-agent-browser.md and its manifest at https://skillstore.io/api/skills/inference-sh-9-agent-browser/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "agent-browser". Inspect a product page and capture useful evidence.
Expected outcome:
A concise page report with title, URL, visible controls, extracted text highlights, link summary, and screenshot availability.
Using "agent-browser". Submit a test contact form and verify completion.
Expected outcome:
A workflow summary showing filled fields, submitted action, final page state, success indicators, and validation messages.
Using "agent-browser". Record a failing browser interaction for review.
Expected outcome:
A debugging note with the failed action, current page state, likely cause, and the saved recording reference.
Security Audit
Criticalv5 • 7/6/2026 Open versioned report
Most static shell, URL, filesystem, and Markdown backtick findings are benign documentation or formatting artifacts. Confirmed risks include the pipe-to-shell installer, screen and video capture, SOCKS proxy routing, executable shell templates, cookie extraction, arbitrary page JavaScript, proxy rotation, and local file upload. No prompt injection attempt was found in the reviewed files.
9
Files scanned
2,107
Lines analyzed
31
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh && infsh login
Line 17 pipes a downloaded installer from https://cli.inference.sh directly into sh. If the endpoint or transport is compromised, this executes remote code on the user machine.
High
Screen capture upload
description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e
The skill description declares screenshots and video recording for browser sessions. Captured pages can contain credentials, tokens, or private records returned through an external service.
High
Arbitrary Page JavaScript And Cookie Extraction
The execute function runs supplied JavaScript in the page context, and the authentication guide shows extracting document.cookie. This can expose active sessions or protected page data.
The command reference documents arbitrary JavaScript execution, and the authentication guide applies it to cookie extraction. The risk is direct and tied to authenticated browsing.
High
Proxy Rotation For Rate Limit Avoidance
The proxy guide includes a rate-limit avoidance workflow that rotates proxies while scraping pages. This can support evasion of service limits or source attribution.
The heading and sample workflow explicitly describe rotating proxies for web scraping under rate-limit avoidance. Legitimate testing is possible, but the abuse path is clear.
High
Sensitive Session Recording And Artifact Storage
The video guide records browser activity and includes an administrative task recording workflow that stores video artifacts. These files can capture secrets or private records.
The guide documents full-session recording and later warns not to record sensitive sessions. That warning confirms the realistic exposure risk.
High
Local File Upload Capability
The interact action supports uploading local file paths through browser file inputs. Misuse could send unintended local files to web applications.
Both the main skill and command reference document file_paths for upload actions. This is a legitimate feature with a concrete exfiltration risk if misused.
Capability review items (31)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION --input '{
The cited authentication example extracts browser cookie data with page JavaScript and stores it in shell variables. That can expose active session material from authenticated pages.
High
Shell command substitution
COOKIES=$(echo $RESULT | jq -r '.result')
The cited authentication example extracts browser cookie data with page JavaScript and stores it in shell variables. That can expose active session material from authenticated pages.
High
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION --input '{
The cited authentication example extracts browser cookie data with page JavaScript and stores it in shell variables. That can expose active session material from authenticated pages.
High
Shell command substitution
PROXY_INDEX=$((i % ${#PROXIES[@]}))
This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.
High
Shell command substitution
echo "Fetching $URL via proxy $((PROXY_INDEX + 1))"
This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.
High
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.
High
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION --input '{
This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.
High
Unix shell invocation
#!/bin/bash
This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.
High
SOCKS proxy
"proxy_url": "socks5://privacy-proxy.example.com:1080"
The proxy documentation explicitly supports SOCKS5 proxy routing. This is a dual-use anonymity and traffic-routing feature that can bypass source attribution or access controls.
High
SOCKS proxy
### SOCKS5 Proxy
The proxy documentation explicitly supports SOCKS5 proxy routing. This is a dual-use anonymity and traffic-routing feature that can bypass source attribution or access controls.
High
SOCKS proxy
{"proxy_url": "socks5://proxy.example.com:1080"}
The proxy documentation explicitly supports SOCKS5 proxy routing. This is a dual-use anonymity and traffic-routing feature that can bypass source attribution or access controls.
High
Shell command substitution
TASK_ID=$(date +%Y%m%d-%H%M%S)
This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.
High
Shell command substitution
SESSION=$(infsh app run agent-browser --function open --session new --input '{
This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.
High
Shell command substitution
RESULT=$(infsh app run agent-browser --function close --session $SESSION --input '{}')
This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.
High
Shell command substitution
VIDEO=$(echo $RESULT | jq -r '.video')
This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.
High
Unix shell invocation
#!/bin/bash
This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.
Medium
Shell command substitution
TOTP_CODE=$(oathtool --totp -b "$TOTP_SECRET")
The example generates a TOTP code from a secret in a shell workflow. This is legitimate automation but handles MFA secrets and deserves review.
Medium
Shell command substitution
RESULT=$(infsh app run agent-browser --function open --session new --input '{
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
SESSION_ID=$(echo $RESULT | jq -r '.session_id')
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
CLOSE_RESULT=$(infsh app run agent-browser --function close --session $SESSION_ID --input '{}' 2>/de
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
VIDEO=$(echo $CLOSE_RESULT | jq -r '.video // empty')
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
RESULT=$(infsh app run agent-browser --function open --session new --input '{
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
SESSION_ID=$(echo $RESULT | jq -r '.session_id')
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
URL=$(echo $RESULT | jq -r '.url')
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
TITLE=$(echo $RESULT | jq -r '.title')
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
RESULT=$(infsh app run agent-browser --function open --session new --input '{
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Medium
Shell command substitution
SESSION_ID=$(echo $RESULT | jq -r '.session_id')
This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.
Low
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh && infsh login
The URL is the remote installer endpoint used by the pipe-to-shell command. The URL itself is expected, but it contributes to the remote code execution installation risk.
Risk Factors
⚙️ External commands (163)
references/authentication.md:24-26 references/authentication.md:51 references/authentication.md:52 references/authentication.md:70-72 references/authentication.md:80 references/authentication.md:97 references/authentication.md:115 references/authentication.md:116 references/authentication.md:128 references/authentication.md:129 references/authentication.md:133 references/authentication.md:153-156 references/authentication.md:179-181 references/authentication.md:202 references/authentication.md:215-217 references/authentication.md:218 references/authentication.md:222-223 references/authentication.md:243 references/authentication.md:246 references/authentication.md:285 references/authentication.md:292 references/authentication.md:21 references/authentication.md:68 references/authentication.md:174 references/proxy-support.md:22-25 references/proxy-support.md:35-40 references/proxy-support.md:65-68 references/proxy-support.md:76 references/proxy-support.md:107 references/proxy-support.md:111 references/proxy-support.md:113-116 references/proxy-support.md:119-121 references/proxy-support.md:137-142 references/proxy-support.md:150-153 references/proxy-support.md:186-189 references/proxy-support.md:192-194 references/proxy-support.md:195 references/proxy-support.md:267-270 references/proxy-support.md:273 references/proxy-support.md:294 references/proxy-support.md:50 references/proxy-support.md:90 references/snapshot-refs.md:124-126 references/snapshot-refs.md:136-138 references/snapshot-refs.md:140 references/snapshot-refs.md:142 references/video-recording.md:23-26 references/video-recording.md:38 references/video-recording.md:39 references/video-recording.md:48-52 references/video-recording.md:87-90 references/video-recording.md:93-95 references/video-recording.md:97 references/video-recording.md:100 references/video-recording.md:103 references/video-recording.md:104 references/video-recording.md:119-124 references/video-recording.md:156 references/video-recording.md:157 references/video-recording.md:168-171 references/video-recording.md:178 references/video-recording.md:179 references/video-recording.md:195 references/video-recording.md:197-200 references/video-recording.md:206 references/video-recording.md:207 references/video-recording.md:84 references/video-recording.md:116 references/video-recording.md:163 references/video-recording.md:192 SKILL.md:9 SKILL.md:15-21 SKILL.md:21-23 SKILL.md:23-29 SKILL.md:29-34 SKILL.md:34-58 SKILL.md:58-64 SKILL.md:64-65 SKILL.md:65 SKILL.md:66 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69-75 SKILL.md:75 SKILL.md:76 SKILL.md:77 SKILL.md:78 SKILL.md:79 SKILL.md:80 SKILL.md:81 SKILL.md:82 SKILL.md:83 SKILL.md:84 SKILL.md:85 SKILL.md:86 SKILL.md:87-88 SKILL.md:88 SKILL.md:89 SKILL.md:93-95 SKILL.md:95-101 SKILL.md:101-114 SKILL.md:114-127 SKILL.md:127-133 SKILL.md:133-139 SKILL.md:139-147 SKILL.md:147-154 SKILL.md:154-160 SKILL.md:160-166 SKILL.md:166-172 SKILL.md:172-178 SKILL.md:178-184 SKILL.md:184-189 SKILL.md:189-214 SKILL.md:214-228 SKILL.md:228-232 SKILL.md:232-243 SKILL.md:243-247 SKILL.md:247-261 SKILL.md:261-267 SKILL.md:267-268 SKILL.md:268-273 SKILL.md:273-279 SKILL.md:36-38 SKILL.md:39 SKILL.md:116-120 SKILL.md:215-217 SKILL.md:233-235 SKILL.md:248-251 SKILL.md:259 SKILL.md:34-58 SKILL.md:114-127 SKILL.md:214-228 SKILL.md:232-243 SKILL.md:247-261 templates/authenticated-session.sh:40-42 templates/authenticated-session.sh:43 templates/authenticated-session.sh:70-73 templates/authenticated-session.sh:74 templates/authenticated-session.sh:97 templates/authenticated-session.sh:98 templates/authenticated-session.sh:127-128 templates/authenticated-session.sh:130 templates/authenticated-session.sh:1 templates/capture-workflow.sh:28 templates/capture-workflow.sh:31 templates/capture-workflow.sh:54-59 templates/capture-workflow.sh:60 templates/capture-workflow.sh:63 templates/capture-workflow.sh:64 templates/capture-workflow.sh:86 templates/capture-workflow.sh:105-107 templates/capture-workflow.sh:114-115 templates/capture-workflow.sh:126-127 templates/capture-workflow.sh:132-133 templates/capture-workflow.sh:138-139 templates/capture-workflow.sh:1 templates/form-automation.sh:30-32 templates/form-automation.sh:33 templates/form-automation.sh:102 templates/form-automation.sh:104 templates/form-automation.sh:105 templates/form-automation.sh:110 templates/form-automation.sh:1
🌐 Network access (55)
references/authentication.md:25 references/authentication.md:71 references/authentication.md:154 references/authentication.md:180 references/authentication.md:194 references/commands.md:25 references/commands.md:56 references/proxy-support.md:23 references/proxy-support.md:24 references/proxy-support.md:36 references/proxy-support.md:37 references/proxy-support.md:54 references/proxy-support.md:55 references/proxy-support.md:56 references/proxy-support.md:66 references/proxy-support.md:94 references/proxy-support.md:95 references/proxy-support.md:96 references/proxy-support.md:100 references/proxy-support.md:101 references/proxy-support.md:102 references/proxy-support.md:138 references/proxy-support.md:139 references/proxy-support.md:151 references/proxy-support.md:161 references/proxy-support.md:162 references/proxy-support.md:175 references/proxy-support.md:187 references/proxy-support.md:188 references/proxy-support.md:252 references/proxy-support.md:259 references/proxy-support.md:152 references/proxy-support.md:165 references/proxy-support.md:168 references/video-recording.md:24 references/video-recording.md:49 references/video-recording.md:88 references/video-recording.md:120 references/video-recording.md:198 SKILL.md:9 SKILL.md:11 SKILL.md:17 SKILL.md:20 SKILL.md:23 SKILL.md:37 SKILL.md:117 SKILL.md:135 SKILL.md:149 SKILL.md:150 SKILL.md:216 SKILL.md:234 SKILL.md:249 SKILL.md:283 SKILL.md:284 templates/authenticated-session.sh:118
📁 Filesystem access (15)
references/authentication.md:5 references/authentication.md:263 references/commands.md:3 references/commands.md:59 references/proxy-support.md:5 references/proxy-support.md:272 references/snapshot-refs.md:5 references/video-recording.md:5 references/video-recording.md:239 templates/authenticated-session.sh:30 templates/capture-workflow.sh:28 templates/capture-workflow.sh:78 templates/capture-workflow.sh:81 templates/capture-workflow.sh:149 templates/form-automation.sh:23
Detected Patterns
Screen capture uploadPipe to shell pattern
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/inference-sh-9-agent-browser/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/inference-sh-9-agent-browser?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/inference-sh-9-agent-browser?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/inference-sh-9-agent-browser/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/inference-sh-9-agent-browser.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
inference-sh-9. (2026). agent-browser security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/inference-sh-9-agent-browser/audits/5BibTeX citation
@techreport{inference-sh-9-inference-sh-9-agent-browser-2026,
author = {inference-sh-9},
title = {agent-browser security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/inference-sh-9-agent-browser/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "agent-browser security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "inference-sh-9"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/inference-sh-9-agent-browser/audits/5"
identifiers:
- type: other
value: "skillstore:inference-sh-9-agent-browser:audit:5"
description: "Skillstore immutable audit report identifier"
Compare variants
19 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Highest Skillstore Score
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
supercent-io Recommended
supercent-io-agent-browser
Skillstore Score 78
Evidence Confidence High
Skillstore usage 30
Updated
2026-08-21
101-skills-agent-browser
Skillstore Score 74
Evidence Confidence Medium
Skillstore usage 1
Updated
2026-08-21
vercel-labs-agent-browser
Skillstore Score 38
Evidence Confidence High
Skillstore usage 66
Updated
2026-08-21
qu-skills-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 40
Updated
2026-08-21
am-will-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 36
Updated
2026-08-21
tul-sh-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 35
Updated
2026-08-21
inference-sh-8-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 25
Updated
2026-08-21
toolshell-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 16
Updated
2026-08-21
skillssh-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 16
Updated
2026-08-21
inference-sh-9 Current
inference-sh-9-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 15
Updated
2026-08-21
inferen-sh-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 10
Updated
2026-08-21
inference-shell-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 10
Updated
2026-08-21
inferencesh-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 10
Updated
2026-08-21
inference-sh-skills-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 9
Updated
2026-08-21
inference-sh-0-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 9
Updated
2026-08-21
infsh-skills-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated
2026-08-21
inf-sh-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated
2026-08-21
inference-skills-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 6
Updated
2026-08-21
halt-catch-fire-agent-browser
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 3
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 45
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
QA Regression Checks
Run repeatable browser flows, capture evidence, and inspect failures with screenshots or video.
Research Page Capture
Open target pages, extract visible text, collect links, and save screenshots for review.
Internal Workflow Automation
Automate approved forms and authenticated tasks when credentials and data handling are controlled.
Try These Prompts
Open a Page
Open the target URL with agent-browser. Show the page title, current URL, screenshot status, and available @e refs.
Fill a Simple Form
Use agent-browser to inspect this form, fill the required fields with my provided values, submit it, and verify the result.
Capture Research Evidence
Browse these approved pages, capture screenshots, extract visible text and links, and summarize key findings with source URLs.
Debug an Authenticated Flow
Use an existing approved session to reproduce this workflow, record only non-sensitive steps, and report failed refs or page changes.
Best Practices
- Use only approved websites, accounts, and data sources before automating browser actions.
- Disable video recording when pages may show passwords, tokens, payment data, or private records.
- Re-snapshot after every navigation, form submission, modal change, or dynamic content update.
Avoid
- Do not use proxy rotation to evade rate limits, access controls, or website terms.
- Do not print, store, or share cookies, passwords, screenshots, or videos containing secrets.
- Do not run bundled shell templates before reviewing URLs, output paths, and credential handling.
Frequently Asked Questions
What does this skill automate?
It automates browser navigation, element interaction, screenshots, video recording, JavaScript execution, proxy setup, and common shell workflows.
Does it require an external service?
Yes. It relies on inference.sh and the infsh CLI to run the browser automation functions.
Can it handle login flows?
Yes, but only use approved accounts and avoid logging passwords, cookies, screenshots, or videos with sensitive data.
Can it run JavaScript?
Yes. The execute function runs custom JavaScript in the current page context, which can extract or modify page data.
Why are @e refs important?
They provide compact references for clickable and editable elements, but they must be refreshed after page changes.
Is this safe to publish without review?
No. It is a high-risk dual-use browser automation skill and should receive human review before publication.
Developer Details
Author
inference-sh-9License
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
a06681402992ceae98ba04d54cfd4ab004862696
Maintenance freshness
7/18/2026
Usage
13 downloads · 213 views
File structure