Versioned security assessment

Report ID: SA-8B8234BA

6/30/2026, 4:07:37 AM

agent-browser security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
agent-browser
Version
v3
Maintainer
inference-sh-9
Source
github.com/inference-sh-9/skills/tree/main/skills/agentic-browser/
Coverage
9 Files scanned · 2,107 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis found many command, network, filesystem, and sensitive-data patterns. Most shell detections are documented inference.sh examples, but the skill also enables authenticated browsing, cookie extraction, file upload, screenshots, video recording, arbitrary page JavaScript, proxy rotation, and a pipe-to-shell installer. No prompt injection attempt was found, and no confirmed malicious intent was found, so this is high risk rather than blocked.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

9 Files scanned · 2,107 Lines analyzed

6 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 3 evidence locations

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 5 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 5 evidence locations

Capability review items (6)
High
references/authentication.md:31-38references/authentication.md:171-205references/authentication.md:213-219
Sensitive Authenticated Session and Cookie Extraction Guidance
The authentication guide demonstrates filling passwords, persisting authenticated sessions, extracting document cookies, and printing cookies. This can expose session tokens if used on accounts without strict consent and redaction.
The cited lines explicitly automate credential entry and retrieve cookies from an authenticated browser session. The behavior is legitimate for owned accounts but creates clear token exposure risk.
High
references/proxy-support.md:85-128references/proxy-support.md:149-153
Proxy Rotation and Rate Limit Avoidance Workflow
The proxy guide includes a rate limit avoidance section that rotates proxies while scraping pages. This can support abuse of third-party sites and evasion of site controls.
The section title and example directly describe rotating proxies for scraping and avoiding rate limits. Legitimate testing is possible, but the abuse-enabling intent is explicit.
High
SKILL.md:64-69SKILL.md:156-165references/commands.md:162-176
Arbitrary Page JavaScript Execution and Local File Upload Capability
The skill exposes page JavaScript execution and file upload actions. These features can extract page data or upload local files when directed by a user or compromised workflow.
The functions are explicitly documented and operational. The JavaScript runs in page context, not host context, so this is high dual-use risk rather than confirmed host compromise.
Medium
SKILL.md:15-23
Remote Pipe-to-Shell Installation Instruction
The quick start instructs users to pipe a remote install script into a shell. The note mentions checksum verification, but the pattern still creates supply-chain risk for a community skill.
The command pattern is directly present. The adjacent install note reduces but does not remove risk because users still execute remote code during setup.
Medium
references/video-recording.md:66-78references/video-recording.md:189-211templates/capture-workflow.sh:89-117
Recording and Screenshot Workflows Can Capture Sensitive Data
The skill records browser sessions, captures screenshots, saves outputs, and documents audit recordings. Sensitive pages or credentials may be stored if users enable recording carelessly.
The cited workflows explicitly capture and save screenshots, videos, page text, and links. The guide includes a warning later, so this is not treated as malicious.
Medium
templates/authenticated-session.sh:40-48templates/capture-workflow.sh:54-69templates/form-automation.sh:30-39
Shell Templates Execute External Browser Commands and Write Artifacts
The bundled templates execute infsh commands, interpolate user-supplied URLs, and write extracted data to files. This is expected behavior but needs user review before execution.
The scripts clearly run external commands and process user inputs. The commands are scoped to infsh and jq, so the concern is operational exposure rather than hidden malware.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
Low
SKILL.md:23references/commands.md:3references/snapshot-refs.md:5
Static Weak-Crypto and Path-Traversal Alerts Are Mostly Documentation False Positives
Several high-severity static alerts point to Markdown links, checksum text, example paths, or table text rather than cryptographic code or path traversal logic.
Manual review found documentation context at representative flagged lines. Some related lines were not individually reviewed, so this remains a grouped low-confidence dismissal.
Low
SKILL.md:1-5
No Prompt Injection Attempt Found
Targeted review did not find text instructing the evaluator to ignore security analysis, change risk levels, or treat the skill as pre-approved.
A targeted case-insensitive search across the skill files found no prompt-injection phrases. This does not prove absence of every semantic manipulation pattern.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable