📦

Audit History

agent-browser - 5 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Review items	Change vs previous
v5 Latest	Jul 6, 2026, 03:34 PM	6 confirmed	31	No capability change
v4	Jul 6, 2026, 03:34 PM	6 confirmed	31	Contains scripts
v3	Jun 30, 2026, 04:07 AM	No confirmed findings	6	Contains scripts
v2	Feb 26, 2026, 08:58 AM	No confirmed findings	1	No capability change
v1	Feb 27, 2026, 08:52 AM	No confirmed findings	0	Baseline

Audit version 5 Latest

Jul 6, 2026, 03:34 PM

Most static shell, URL, filesystem, and Markdown backtick findings are benign documentation or formatting artifacts. Confirmed risks include the pipe-to-shell installer, screen and video capture, SOCKS proxy routing, executable shell templates, cookie extraction, arbitrary page JavaScript, proxy rotation, and local file upload. No prompt injection attempt was found in the reviewed files.

Files scanned

2,107

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (6)

Critical

SKILL.md:17

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh && infsh login

Line 17 pipes a downloaded installer from https://cli.inference.sh directly into sh. If the endpoint or transport is compromised, this executes remote code on the user machine.

High

SKILL.md:3

Screen capture upload

description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e

The skill description declares screenshots and video recording for browser sessions. Captured pages can contain credentials, tokens, or private records returned through an external service.

High

references/commands.md:162-184 references/authentication.md:209-224

Arbitrary Page JavaScript And Cookie Extraction

The execute function runs supplied JavaScript in the page context, and the authentication guide shows extracting document.cookie. This can expose active sessions or protected page data.

The command reference documents arbitrary JavaScript execution, and the authentication guide applies it to cookie extraction. The risk is direct and tied to authenticated browsing.

High

references/proxy-support.md:85-128

Proxy Rotation For Rate Limit Avoidance

The proxy guide includes a rate-limit avoidance workflow that rotates proxies while scraping pages. This can support evasion of service limits or source attribution.

The heading and sample workflow explicitly describe rotating proxies for web scraping under rate-limit avoidance. Legitimate testing is possible, but the abuse path is clear.

High

references/video-recording.md:189-211 references/video-recording.md:259-270

Sensitive Session Recording And Artifact Storage

The video guide records browser activity and includes an administrative task recording workflow that stores video artifacts. These files can capture secrets or private records.

The guide documents full-session recording and later warns not to record sensitive sessions. That warning confirms the realistic exposure risk.

High

SKILL.md:156-165 references/commands.md:95-113

Local File Upload Capability

The interact action supports uploading local file paths through browser file inputs. Misuse could send unintended local files to web applications.

Both the main skill and command reference document file_paths for upload actions. This is a legitimate feature with a concrete exfiltration risk if misused.

Capability review items (31)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/authentication.md:215-217 references/authentication.md:222-223 references/proxy-support.md:119-121

Shell command substitution · 3 occurrences

RESULT=$(infsh app run agent-browser --function execute --session $SESSION --input '{

The cited authentication example extracts browser cookie data with page JavaScript and stores it in shell variables. That can expose active session material from authenticated pages.

High

references/authentication.md:218

Shell command substitution

COOKIES=$(echo $RESULT | jq -r '.result')

The cited authentication example extracts browser cookie data with page JavaScript and stores it in shell variables. That can expose active session material from authenticated pages.

High

references/proxy-support.md:107

Shell command substitution

PROXY_INDEX=$((i % ${#PROXIES[@]}))

This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.

High

references/proxy-support.md:111

Shell command substitution

echo "Fetching $URL via proxy $((PROXY_INDEX + 1))"

This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.

High

references/proxy-support.md:113-116 references/video-recording.md:197-200

Shell command substitution · 2 occurrences

SESSION=$(infsh app run agent-browser --function open --session new --input '{

This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.

High

references/proxy-support.md:90 references/video-recording.md:192

Unix shell invocation · 2 occurrences

#!/bin/bash

This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.

High

references/proxy-support.md:152

SOCKS proxy

"proxy_url": "socks5://privacy-proxy.example.com:1080"

The proxy documentation explicitly supports SOCKS5 proxy routing. This is a dual-use anonymity and traffic-routing feature that can bypass source attribution or access controls.

High

references/proxy-support.md:165

SOCKS proxy

### SOCKS5 Proxy

The proxy documentation explicitly supports SOCKS5 proxy routing. This is a dual-use anonymity and traffic-routing feature that can bypass source attribution or access controls.

High

references/proxy-support.md:168

SOCKS proxy

{"proxy_url": "socks5://proxy.example.com:1080"}

The proxy documentation explicitly supports SOCKS5 proxy routing. This is a dual-use anonymity and traffic-routing feature that can bypass source attribution or access controls.

High

references/video-recording.md:195

Shell command substitution

TASK_ID=$(date +%Y%m%d-%H%M%S)

This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.

High

references/video-recording.md:206

Shell command substitution

RESULT=$(infsh app run agent-browser --function close --session $SESSION --input '{}')

This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.

High

references/video-recording.md:207

Shell command substitution

VIDEO=$(echo $RESULT | jq -r '.video')

This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.

Medium

references/authentication.md:133

Shell command substitution

TOTP_CODE=$(oathtool --totp -b "$TOTP_SECRET")

The example generates a TOTP code from a secret in a shell workflow. This is legitimate automation but handles MFA secrets and deserves review.

Medium

templates/authenticated-session.sh:40-42 templates/capture-workflow.sh:54-59 templates/form-automation.sh:30-32

Shell command substitution · 3 occurrences

RESULT=$(infsh app run agent-browser --function open --session new --input '{

This is an executable shell template that invokes the external infsh CLI and processes browser session data. The behavior is legitimate automation, but it is a real command-execution and data-handling risk.

Medium

templates/authenticated-session.sh:43 templates/capture-workflow.sh:60 templates/form-automation.sh:33

Shell command substitution · 3 occurrences

SESSION_ID=$(echo $RESULT | jq -r '.session_id')

Medium

templates/capture-workflow.sh:28

Shell command substitution

CLOSE_RESULT=$(infsh app run agent-browser --function close --session $SESSION_ID --input '{}' 2>/de

Medium

templates/capture-workflow.sh:31

Shell command substitution

VIDEO=$(echo $CLOSE_RESULT | jq -r '.video // empty')

Medium

templates/capture-workflow.sh:63

Shell command substitution

URL=$(echo $RESULT | jq -r '.url')

Medium

templates/capture-workflow.sh:64

Shell command substitution

TITLE=$(echo $RESULT | jq -r '.title')

Medium

templates/capture-workflow.sh:86

Shell command substitution

RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')

Medium

templates/capture-workflow.sh:105-107 templates/capture-workflow.sh:114-115

Shell command substitution · 2 occurrences

RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{

Low

SKILL.md:17

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh && infsh login

The URL is the remote installer endpoint used by the pipe-to-shell command. The URL itself is expected, but it contributes to the remote code execution installation risk.

Risk Factors

⚙️ External commands (163)

🌐 Network access (55)

📁 Filesystem access (15)

references/authentication.md:5 references/authentication.md:263 references/commands.md:3 references/commands.md:59 references/proxy-support.md:5 references/proxy-support.md:272 references/snapshot-refs.md:5 references/video-recording.md:5 references/video-recording.md:239 templates/authenticated-session.sh:30 templates/capture-workflow.sh:28 templates/capture-workflow.sh:78 templates/capture-workflow.sh:81 templates/capture-workflow.sh:149 templates/form-automation.sh:23

Detected Patterns

Screen capture uploadPipe to shell pattern

Audited by: codex

Audit version 4

Jul 6, 2026, 03:34 PM

Files scanned

2,107

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (6)

Critical

SKILL.md:17

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh && infsh login

Line 17 pipes a downloaded installer from https://cli.inference.sh directly into sh. If the endpoint or transport is compromised, this executes remote code on the user machine.

High

SKILL.md:3

Screen capture upload

description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e

The skill description declares screenshots and video recording for browser sessions. Captured pages can contain credentials, tokens, or private records returned through an external service.

High

references/commands.md:162-184 references/authentication.md:209-224

Arbitrary Page JavaScript And Cookie Extraction

The execute function runs supplied JavaScript in the page context, and the authentication guide shows extracting document.cookie. This can expose active sessions or protected page data.

The command reference documents arbitrary JavaScript execution, and the authentication guide applies it to cookie extraction. The risk is direct and tied to authenticated browsing.

High

references/proxy-support.md:85-128

Proxy Rotation For Rate Limit Avoidance

The proxy guide includes a rate-limit avoidance workflow that rotates proxies while scraping pages. This can support evasion of service limits or source attribution.

The heading and sample workflow explicitly describe rotating proxies for web scraping under rate-limit avoidance. Legitimate testing is possible, but the abuse path is clear.

High

references/video-recording.md:189-211 references/video-recording.md:259-270

Sensitive Session Recording And Artifact Storage

The video guide records browser activity and includes an administrative task recording workflow that stores video artifacts. These files can capture secrets or private records.

The guide documents full-session recording and later warns not to record sensitive sessions. That warning confirms the realistic exposure risk.

High

SKILL.md:156-165 references/commands.md:95-113

Local File Upload Capability

The interact action supports uploading local file paths through browser file inputs. Misuse could send unintended local files to web applications.

Both the main skill and command reference document file_paths for upload actions. This is a legitimate feature with a concrete exfiltration risk if misused.

Capability review items (31)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/authentication.md:215-217 references/authentication.md:222-223 references/proxy-support.md:119-121

Shell command substitution · 3 occurrences

RESULT=$(infsh app run agent-browser --function execute --session $SESSION --input '{

The cited authentication example extracts browser cookie data with page JavaScript and stores it in shell variables. That can expose active session material from authenticated pages.

High

references/authentication.md:218

Shell command substitution

COOKIES=$(echo $RESULT | jq -r '.result')

The cited authentication example extracts browser cookie data with page JavaScript and stores it in shell variables. That can expose active session material from authenticated pages.

High

references/proxy-support.md:107

Shell command substitution

PROXY_INDEX=$((i % ${#PROXIES[@]}))

This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.

High

references/proxy-support.md:111

Shell command substitution

echo "Fetching $URL via proxy $((PROXY_INDEX + 1))"

This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.

High

references/proxy-support.md:113-116 references/video-recording.md:197-200

Shell command substitution · 2 occurrences

SESSION=$(infsh app run agent-browser --function open --session new --input '{

This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.

High

references/proxy-support.md:90 references/video-recording.md:192

Unix shell invocation · 2 occurrences

#!/bin/bash

This command appears in the rate-limit-avoidance proxy rotation example. The workflow can facilitate scraping at scale while obscuring request origin.

High

references/proxy-support.md:152

SOCKS proxy

"proxy_url": "socks5://privacy-proxy.example.com:1080"

The proxy documentation explicitly supports SOCKS5 proxy routing. This is a dual-use anonymity and traffic-routing feature that can bypass source attribution or access controls.

High

references/proxy-support.md:165

SOCKS proxy

### SOCKS5 Proxy

The proxy documentation explicitly supports SOCKS5 proxy routing. This is a dual-use anonymity and traffic-routing feature that can bypass source attribution or access controls.

High

references/proxy-support.md:168

SOCKS proxy

{"proxy_url": "socks5://proxy.example.com:1080"}

The proxy documentation explicitly supports SOCKS5 proxy routing. This is a dual-use anonymity and traffic-routing feature that can bypass source attribution or access controls.

High

references/video-recording.md:195

Shell command substitution

TASK_ID=$(date +%Y%m%d-%H%M%S)

This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.

High

references/video-recording.md:206

Shell command substitution

RESULT=$(infsh app run agent-browser --function close --session $SESSION --input '{}')

This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.

High

references/video-recording.md:207

Shell command substitution

VIDEO=$(echo $RESULT | jq -r '.video')

This recording workflow targets administrative tasks and saves video artifacts. Such recordings can capture sensitive authenticated actions or private data.

Medium

references/authentication.md:133

Shell command substitution

TOTP_CODE=$(oathtool --totp -b "$TOTP_SECRET")

The example generates a TOTP code from a secret in a shell workflow. This is legitimate automation but handles MFA secrets and deserves review.

Medium

templates/authenticated-session.sh:40-42 templates/capture-workflow.sh:54-59 templates/form-automation.sh:30-32

Shell command substitution · 3 occurrences

RESULT=$(infsh app run agent-browser --function open --session new --input '{

Medium

templates/authenticated-session.sh:43 templates/capture-workflow.sh:60 templates/form-automation.sh:33

Shell command substitution · 3 occurrences

SESSION_ID=$(echo $RESULT | jq -r '.session_id')

Medium

templates/capture-workflow.sh:28

Shell command substitution

CLOSE_RESULT=$(infsh app run agent-browser --function close --session $SESSION_ID --input '{}' 2>/de

Medium

templates/capture-workflow.sh:31

Shell command substitution

VIDEO=$(echo $CLOSE_RESULT | jq -r '.video // empty')

Medium

templates/capture-workflow.sh:63

Shell command substitution

URL=$(echo $RESULT | jq -r '.url')

Medium

templates/capture-workflow.sh:64

Shell command substitution

TITLE=$(echo $RESULT | jq -r '.title')

Medium

templates/capture-workflow.sh:86

Shell command substitution

RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')

Medium

templates/capture-workflow.sh:105-107 templates/capture-workflow.sh:114-115

Shell command substitution · 2 occurrences

RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{

Low

SKILL.md:17

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh && infsh login

The URL is the remote installer endpoint used by the pipe-to-shell command. The URL itself is expected, but it contributes to the remote code execution installation risk.

Risk Factors

⚙️ External commands (163)

🌐 Network access (55)

📁 Filesystem access (15)

Detected Patterns

Screen capture uploadPipe to shell pattern

Audited by: codex

Audit version 3

Jun 30, 2026, 04:07 AM

Static analysis found many command, network, filesystem, and sensitive-data patterns. Most shell detections are documented inference.sh examples, but the skill also enables authenticated browsing, cookie extraction, file upload, screenshots, video recording, arbitrary page JavaScript, proxy rotation, and a pipe-to-shell installer. No prompt injection attempt was found, and no confirmed malicious intent was found, so this is high risk rather than blocked.

Files scanned

2,107

Lines analyzed

Review items

False positives ignored

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/authentication.md:31-38 references/authentication.md:171-205 references/authentication.md:213-219

Sensitive Authenticated Session and Cookie Extraction Guidance

The authentication guide demonstrates filling passwords, persisting authenticated sessions, extracting document cookies, and printing cookies. This can expose session tokens if used on accounts without strict consent and redaction.

The cited lines explicitly automate credential entry and retrieve cookies from an authenticated browser session. The behavior is legitimate for owned accounts but creates clear token exposure risk.

High

references/proxy-support.md:85-128 references/proxy-support.md:149-153

Proxy Rotation and Rate Limit Avoidance Workflow

The proxy guide includes a rate limit avoidance section that rotates proxies while scraping pages. This can support abuse of third-party sites and evasion of site controls.

The section title and example directly describe rotating proxies for scraping and avoiding rate limits. Legitimate testing is possible, but the abuse-enabling intent is explicit.

High

SKILL.md:64-69 SKILL.md:156-165 references/commands.md:162-176

Arbitrary Page JavaScript Execution and Local File Upload Capability

The skill exposes page JavaScript execution and file upload actions. These features can extract page data or upload local files when directed by a user or compromised workflow.

The functions are explicitly documented and operational. The JavaScript runs in page context, not host context, so this is high dual-use risk rather than confirmed host compromise.

Medium

SKILL.md:15-23

Remote Pipe-to-Shell Installation Instruction

The quick start instructs users to pipe a remote install script into a shell. The note mentions checksum verification, but the pattern still creates supply-chain risk for a community skill.

The command pattern is directly present. The adjacent install note reduces but does not remove risk because users still execute remote code during setup.

Medium

references/video-recording.md:66-78 references/video-recording.md:189-211 templates/capture-workflow.sh:89-117

Recording and Screenshot Workflows Can Capture Sensitive Data

The skill records browser sessions, captures screenshots, saves outputs, and documents audit recordings. Sensitive pages or credentials may be stored if users enable recording carelessly.

The cited workflows explicitly capture and save screenshots, videos, page text, and links. The guide includes a warning later, so this is not treated as malicious.

Medium

templates/authenticated-session.sh:40-48 templates/capture-workflow.sh:54-69 templates/form-automation.sh:30-39

Shell Templates Execute External Browser Commands and Write Artifacts

The bundled templates execute infsh commands, interpolate user-supplied URLs, and write extracted data to files. This is expected behavior but needs user review before execution.

The scripts clearly run external commands and process user inputs. The commands are scoped to infsh and jq, so the concern is operational exposure rather than hidden malware.

Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

SKILL.md:23 references/commands.md:3 references/snapshot-refs.md:5

Static Weak-Crypto and Path-Traversal Alerts Are Mostly Documentation False Positives

Several high-severity static alerts point to Markdown links, checksum text, example paths, or table text rather than cryptographic code or path traversal logic.

Manual review found documentation context at representative flagged lines. Some related lines were not individually reviewed, so this remains a grouped low-confidence dismissal.

Low

SKILL.md:1-5

No Prompt Injection Attempt Found

Targeted review did not find text instructing the evaluator to ignore security analysis, change risk levels, or treat the skill as pre-approved.

A targeted case-insensitive search across the skill files found no prompt-injection phrases. This does not prove absence of every semantic manipulation pattern.

Risk Factors

⚡ Contains scripts (3)

templates/authenticated-session.sh:1 templates/capture-workflow.sh:1 templates/form-automation.sh:1

⚙️ External commands (5)

SKILL.md:15-20 templates/authenticated-session.sh:40-43 templates/capture-workflow.sh:54-60 templates/form-automation.sh:30-33 references/authentication.md:213-219

🌐 Network access (4)

SKILL.md:17-23 references/commands.md:23-34 references/proxy-support.md:85-128 references/proxy-support.md:149-153

📁 Filesystem access (5)

SKILL.md:160-165 templates/capture-workflow.sh:22-34 templates/capture-workflow.sh:68-117 references/video-recording.md:181-184 references/video-recording.md:205-211

Detected Patterns

Pipe to Shell InstallerCookie Extraction From Browser SessionProxy-Based Rate Limit AvoidanceArbitrary Page JavaScript Execution

Audited by: codex

Audit version 2

Feb 26, 2026, 08:58 AM

Static analysis detected 609 patterns but evaluation confirms these are FALSE POSITIVES. External command patterns are legitimate CLI calls to inference.sh service. Hardcoded URLs are official service endpoints. Path traversal patterns are markdown documentation links. Browser credential references describe session state storage (cookies, localStorage), not file access. No malicious intent or security vulnerabilities detected. The skill is a legitimate browser automation tool with expected remote service communication.

Files scanned

2,312

Lines analyzed

Review items

False positives ignored

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low

SKILL.md:17

Documentation references curl pipe to shell

Install documentation mentions 'curl | sh' pattern which is generally discouraged for security. However, this is documentation only, not executable skill code, and points to official inference.sh CLI.

Risk Factors

⚙️ External commands (3)

SKILL.md:17 SKILL.md:20 SKILL.md:36-38

🌐 Network access (3)

SKILL.md:9 SKILL.md:17 SKILL.md:23

📁 Filesystem access (1)

SKILL.md:5

Audited by: claude

Audit version 1

Feb 27, 2026, 08:52 AM

All 609 static analysis findings are false positives from documentation and template files. The skill contains only legitimate bash scripts demonstrating browser automation workflows. External command patterns are CLI examples showing proper infsh usage. Network findings are example URLs in documentation. No malicious code, credential exfiltration, or unauthorized data transmission detected. The skill is a well-documented browser automation tool with no security concerns.

Files scanned

2,312

Lines analyzed

Review items

False positives ignored

Risk Factors

⚙️ External commands (3)

SKILL.md:9-23 templates/authenticated-session.sh:30-43 templates/form-automation.sh:28-33

🌐 Network access (2)

SKILL.md:9-11 references/commands.md:23-26

📁 Filesystem access (2)

templates/authenticated-session.sh:28-31 templates/capture-workflow.sh:28

Audited by: claude

← Back to Skill