📦

Audit History

agent-browser - 5 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Review items	Change vs previous
v5 Latest	Aug 6, 2026, 11:32 AM	5 confirmed	3	No capability change
v4	Jul 6, 2026, 02:34 PM	3 confirmed	45	No capability change
v3	Jul 6, 2026, 02:34 PM	3 confirmed	45	Contains scripts
v2	Jun 30, 2026, 04:25 AM	2 confirmed	5	Contains scripts
v1	Apr 29, 2026, 08:55 AM	1 confirmed	2	Baseline

Audit version 5 Latest

Aug 6, 2026, 11:32 AM

Most static hits are false positives caused by Markdown syntax, fenced shell examples, placeholder URLs, relative links, and /dev/null redirection. Confirmed risks include external installation, remote image loading, TOTP exposure through process arguments, and remote screen capture. Credential submission, cookie extraction, local file upload, and page JavaScript require explicit consent and strict scoping.

Files scanned

2,315

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (5)

High

SKILL.md:3

Screen capture upload

description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e

The declared capability captures screenshots and videos through the inference.sh service. Captured pages may contain credentials, personal data, or authenticated content sent to remote infrastructure.

High

SKILL.md:11 references/authentication.md:31-38 references/authentication.md:99-102 references/authentication.md:131-138

Credentials Sent Through Remote Browser Commands

Authentication examples submit passwords and TOTP codes through inference.sh browser commands, exposing secrets to a third-party execution boundary.

The cited commands explicitly place password and TOTP values into interactions handled by the inference.sh browser service.

High

references/authentication.md:209-219

Session Cookie Disclosure

The authentication guide extracts document.cookie from an authenticated page and prints the result, which can expose reusable session credentials in logs.

The guide explicitly evaluates document.cookie, stores the result, and echoes it under the Cookies label.

High

SKILL.md:158-167

Local File Disclosure Through Upload

The upload action accepts local file paths and sends those files through the remote browser to a website without an explicit confirmation requirement.

The example directly supplies an absolute local file path to the upload action, and the skill states that execution occurs through inference.sh.

Medium

SKILL.md:182-190

Arbitrary Page JavaScript Execution

The skill exposes page-context JavaScript execution, which can read sensitive page data or trigger state changes beyond element-based interactions.

The documented execute function accepts custom JavaScript and returns its result, establishing direct page-context code execution.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

references/authentication.md:133

Shell command substitution

TOTP_CODE=$(oathtool --totp -b "$TOTP_SECRET")

The example passes TOTP_SECRET to oathtool as a command-line argument. Other local users or process-monitoring tools may observe the secret.

Medium

SKILL.md:7

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

Although Markdown backticks do not execute code, this line explicitly directs users to run npx and install an external skill. That creates a real supply-chain execution boundary.

Low

SKILL.md:13

Hardcoded URL

![Agentic Browser](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgjw8atdxgkrs

This Markdown image loads from cloud.inference.sh when rendered. The request discloses viewer network metadata to an external host and depends on mutable remote content.

Risk Factors

⚙️ External commands (50)

🌐 Network access (50)

📁 Filesystem access (17)

references/authentication.md:5 references/authentication.md:263 references/commands.md:3 references/commands.md:59 references/proxy-support.md:5 references/proxy-support.md:272 references/session-management.md:5 references/session-management.md:136 references/snapshot-refs.md:5 references/video-recording.md:5 references/video-recording.md:239 templates/authenticated-session.sh:30 templates/capture-workflow.sh:28 templates/capture-workflow.sh:78 templates/capture-workflow.sh:81 templates/capture-workflow.sh:149 templates/form-automation.sh:23

Detected Patterns

Screen capture upload

Audited by: codex

Audit version 4

Jul 6, 2026, 02:34 PM

Most static shell and URL findings are Markdown examples or expected CLI workflow. The skill still exposes high-risk capabilities: remote browser control, screen or video capture, JavaScript execution, file upload, proxy routing, and authenticated session handling. The documentation also contains rate-limit avoidance and cookie extraction guidance that should be removed before publication.

Files scanned

2,108

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:3

Screen capture upload

description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e

The skill description advertises screenshots, video recording, and file upload through an external browser service. Those features can expose sensitive page or local file data.

High

references/authentication.md:209-224

Cookie Extraction Guidance

The authentication reference includes a Cookie Extraction section that reads document.cookie and prints cookies from an authenticated session.

The section title and commands directly describe extracting cookies from browser sessions, which can expose authentication material.

High

references/proxy-support.md:85-128

Rate Limit Bypass Guidance

The proxy reference teaches rotating proxies for web scraping under a Rate Limit Avoidance heading.

The wording and example proxy rotation loop clearly frame proxy use as a way to avoid rate limits during scraping.

Capability review items (45)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/authentication.md:215-217 references/authentication.md:222-223 references/proxy-support.md:119-121

Shell command substitution · 3 occurrences

RESULT=$(belt app run agent-browser --function execute --session $SESSION --input '{

This is in a Cookie Extraction section and runs page JavaScript to read or print session data. That can expose authentication cookies or browsing tokens.

High

references/authentication.md:218

Shell command substitution

COOKIES=$(echo $RESULT | jq -r '.result')

This is in a Cookie Extraction section and runs page JavaScript to read or print session data. That can expose authentication cookies or browsing tokens.

High

references/proxy-support.md:107

Shell command substitution

PROXY_INDEX=$((i % ${#PROXIES[@]}))

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:111

Shell command substitution

echo "Fetching $URL via proxy $((PROXY_INDEX + 1))"

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:113-116 references/proxy-support.md:150-153

Shell command substitution · 2 occurrences

SESSION=$(belt app run agent-browser --function open --session new --input '{

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:90

Unix shell invocation

#!/bin/bash

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:94

Hardcoded URL

"http://proxy1.example.com:8080"

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:95

Hardcoded URL

"http://proxy2.example.com:8080"

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:96

Hardcoded URL

"http://proxy3.example.com:8080"

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:100

Hardcoded URL

"https://site.com/page1"

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:101

Hardcoded URL

"https://site.com/page2"

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:102

Hardcoded URL

"https://site.com/page3"

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:151

Hardcoded URL

"url": "https://whatismyip.com",

The proxy guidance explicitly supports SOCKS or anonymity routing. In a browser automation skill, this can enable evasive scraping or abuse.

High

references/proxy-support.md:152

SOCKS proxy

"proxy_url": "socks5://privacy-proxy.example.com:1080"

The proxy guidance explicitly supports SOCKS or anonymity routing. In a browser automation skill, this can enable evasive scraping or abuse.

High

references/proxy-support.md:165

SOCKS proxy

### SOCKS5 Proxy

The proxy guidance explicitly supports SOCKS or anonymity routing. In a browser automation skill, this can enable evasive scraping or abuse.

High

references/proxy-support.md:168

SOCKS proxy

{"proxy_url": "socks5://proxy.example.com:1080"}

The proxy guidance explicitly supports SOCKS or anonymity routing. In a browser automation skill, this can enable evasive scraping or abuse.

Medium

references/authentication.md:133

Shell command substitution

TOTP_CODE=$(oathtool --totp -b "$TOTP_SECRET")

The example generates a TOTP code from a secret in shell automation. This can be legitimate, but it handles MFA secrets and enables unattended login workflows.

Medium

SKILL.md:36-38

Shell command substitution

RESULT=$(belt app run agent-browser --function open --session new --input '{

The command captures output from the external belt CLI and drives remote browser automation. This is expected behavior, but it is a real external-command risk surface.

Medium

SKILL.md:39 templates/authenticated-session.sh:43 templates/capture-workflow.sh:60 templates/form-automation.sh:33

Shell command substitution · 4 occurrences

SESSION_ID=$(echo $RESULT | jq -r '.session_id')

The command captures output from the external belt CLI and drives remote browser automation. This is expected behavior, but it is a real external-command risk surface.

Medium

SKILL.md:116-120 SKILL.md:215-217 SKILL.md:233-235 SKILL.md:248-251

Shell command substitution · 4 occurrences

SESSION=$(belt app run agent-browser --function open --session new --input '{

The command captures output from the external belt CLI and drives remote browser automation. This is expected behavior, but it is a real external-command risk surface.

Medium

SKILL.md:259

Shell command substitution

RESULT=$(belt app run agent-browser --function close --session $SESSION --input '{}')

The command captures output from the external belt CLI and drives remote browser automation. This is expected behavior, but it is a real external-command risk surface.

Medium

templates/authenticated-session.sh:40-42 templates/capture-workflow.sh:54-59 templates/form-automation.sh:30-32

Shell command substitution · 3 occurrences

RESULT=$(infsh app run agent-browser --function open --session new --input '{

The active template captures output from infsh, jq, or related commands while driving a browser session. The commands are intended, but they execute external tooling on user-provided targets.

Medium

templates/capture-workflow.sh:28

Shell command substitution

CLOSE_RESULT=$(infsh app run agent-browser --function close --session $SESSION_ID --input '{}' 2>/de

The active template captures output from infsh, jq, or related commands while driving a browser session. The commands are intended, but they execute external tooling on user-provided targets.

Medium

templates/capture-workflow.sh:31

Shell command substitution

VIDEO=$(echo $CLOSE_RESULT | jq -r '.video // empty')

The active template captures output from infsh, jq, or related commands while driving a browser session. The commands are intended, but they execute external tooling on user-provided targets.

Medium

templates/capture-workflow.sh:63

Shell command substitution

URL=$(echo $RESULT | jq -r '.url')

The active template captures output from infsh, jq, or related commands while driving a browser session. The commands are intended, but they execute external tooling on user-provided targets.

Medium

templates/capture-workflow.sh:64

Shell command substitution

TITLE=$(echo $RESULT | jq -r '.title')

The active template captures output from infsh, jq, or related commands while driving a browser session. The commands are intended, but they execute external tooling on user-provided targets.

Medium

templates/capture-workflow.sh:86

Shell command substitution

RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')

The active template captures output from infsh, jq, or related commands while driving a browser session. The commands are intended, but they execute external tooling on user-provided targets.

Medium

templates/capture-workflow.sh:105-107 templates/capture-workflow.sh:114-115

Shell command substitution · 2 occurrences

RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{

The active template captures output from infsh, jq, or related commands while driving a browser session. The commands are intended, but they execute external tooling on user-provided targets.

Low

SKILL.md:9

Hardcoded URL

Browser automation for AI agents via [inference.sh](https://inference.sh). Uses Playwright under the

The URL points to the external inference.sh or installation documentation dependency. It is expected, but users should know the skill relies on third-party network services.

Low

SKILL.md:11

Hardcoded URL

![Agentic Browser](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgjw8atdxgkrs

The URL points to the external inference.sh or installation documentation dependency. It is expected, but users should know the skill relies on third-party network services.

Low

SKILL.md:15

Hardcoded URL

> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer

The URL points to the external inference.sh or installation documentation dependency. It is expected, but users should know the skill relies on third-party network services.

Low

SKILL.md:283

Hardcoded URL

- [inference.sh Sessions](https://inference.sh/docs/extend/sessions) - Session management

The URL points to the external inference.sh or installation documentation dependency. It is expected, but users should know the skill relies on third-party network services.

Low

SKILL.md:284

Hardcoded URL

- [Multi-function Apps](https://inference.sh/docs/extend/multi-function-apps) - How functions work

The URL points to the external inference.sh or installation documentation dependency. It is expected, but users should know the skill relies on third-party network services.

Risk Factors

⚙️ External commands (163)

🌐 Network access (54)

📁 Filesystem access (15)

references/authentication.md:5 references/authentication.md:263 references/commands.md:3 references/commands.md:59 references/proxy-support.md:5 references/proxy-support.md:272 references/snapshot-refs.md:5 references/video-recording.md:5 references/video-recording.md:239 templates/authenticated-session.sh:30 templates/capture-workflow.sh:28 templates/capture-workflow.sh:78 templates/capture-workflow.sh:81 templates/capture-workflow.sh:149 templates/form-automation.sh:23

Detected Patterns

Screen capture upload

Audited by: codex

Audit version 3

Jul 6, 2026, 02:34 PM

Files scanned

2,108

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:3

Screen capture upload

description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e

The skill description advertises screenshots, video recording, and file upload through an external browser service. Those features can expose sensitive page or local file data.

High

references/authentication.md:209-224

Cookie Extraction Guidance

The authentication reference includes a Cookie Extraction section that reads document.cookie and prints cookies from an authenticated session.

The section title and commands directly describe extracting cookies from browser sessions, which can expose authentication material.

High

references/proxy-support.md:85-128

Rate Limit Bypass Guidance

The proxy reference teaches rotating proxies for web scraping under a Rate Limit Avoidance heading.

The wording and example proxy rotation loop clearly frame proxy use as a way to avoid rate limits during scraping.

Capability review items (45)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/authentication.md:215-217 references/authentication.md:222-223 references/proxy-support.md:119-121

Shell command substitution · 3 occurrences

RESULT=$(belt app run agent-browser --function execute --session $SESSION --input '{

This is in a Cookie Extraction section and runs page JavaScript to read or print session data. That can expose authentication cookies or browsing tokens.

High

references/authentication.md:218

Shell command substitution

COOKIES=$(echo $RESULT | jq -r '.result')

This is in a Cookie Extraction section and runs page JavaScript to read or print session data. That can expose authentication cookies or browsing tokens.

High

references/proxy-support.md:107

Shell command substitution

PROXY_INDEX=$((i % ${#PROXIES[@]}))

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:111

Shell command substitution

echo "Fetching $URL via proxy $((PROXY_INDEX + 1))"

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:113-116 references/proxy-support.md:150-153

Shell command substitution · 2 occurrences

SESSION=$(belt app run agent-browser --function open --session new --input '{

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:90

Unix shell invocation

#!/bin/bash

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:94

Hardcoded URL

"http://proxy1.example.com:8080"

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:95

Hardcoded URL

"http://proxy2.example.com:8080"

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:96

Hardcoded URL

"http://proxy3.example.com:8080"

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:100

Hardcoded URL

"https://site.com/page1"

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:101

Hardcoded URL

"https://site.com/page2"

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:102

Hardcoded URL

"https://site.com/page3"

This appears in a Rate Limit Avoidance section that rotates proxies for scraping. That guidance can help bypass target-site access controls.

High

references/proxy-support.md:151

Hardcoded URL

"url": "https://whatismyip.com",

The proxy guidance explicitly supports SOCKS or anonymity routing. In a browser automation skill, this can enable evasive scraping or abuse.

High

references/proxy-support.md:152

SOCKS proxy

"proxy_url": "socks5://privacy-proxy.example.com:1080"

The proxy guidance explicitly supports SOCKS or anonymity routing. In a browser automation skill, this can enable evasive scraping or abuse.

High

references/proxy-support.md:165

SOCKS proxy

### SOCKS5 Proxy

The proxy guidance explicitly supports SOCKS or anonymity routing. In a browser automation skill, this can enable evasive scraping or abuse.

High

references/proxy-support.md:168

SOCKS proxy

{"proxy_url": "socks5://proxy.example.com:1080"}

The proxy guidance explicitly supports SOCKS or anonymity routing. In a browser automation skill, this can enable evasive scraping or abuse.

Medium

references/authentication.md:133

Shell command substitution

TOTP_CODE=$(oathtool --totp -b "$TOTP_SECRET")

The example generates a TOTP code from a secret in shell automation. This can be legitimate, but it handles MFA secrets and enables unattended login workflows.

Medium

SKILL.md:36-38

Shell command substitution

RESULT=$(belt app run agent-browser --function open --session new --input '{

The command captures output from the external belt CLI and drives remote browser automation. This is expected behavior, but it is a real external-command risk surface.

Medium

SKILL.md:39 templates/authenticated-session.sh:43 templates/capture-workflow.sh:60 templates/form-automation.sh:33

Shell command substitution · 4 occurrences

SESSION_ID=$(echo $RESULT | jq -r '.session_id')

The command captures output from the external belt CLI and drives remote browser automation. This is expected behavior, but it is a real external-command risk surface.

Medium

SKILL.md:116-120 SKILL.md:215-217 SKILL.md:233-235 SKILL.md:248-251

Shell command substitution · 4 occurrences

SESSION=$(belt app run agent-browser --function open --session new --input '{

The command captures output from the external belt CLI and drives remote browser automation. This is expected behavior, but it is a real external-command risk surface.

Medium

SKILL.md:259

Shell command substitution

RESULT=$(belt app run agent-browser --function close --session $SESSION --input '{}')

The command captures output from the external belt CLI and drives remote browser automation. This is expected behavior, but it is a real external-command risk surface.

Medium

templates/authenticated-session.sh:40-42 templates/capture-workflow.sh:54-59 templates/form-automation.sh:30-32

Shell command substitution · 3 occurrences

RESULT=$(infsh app run agent-browser --function open --session new --input '{

The active template captures output from infsh, jq, or related commands while driving a browser session. The commands are intended, but they execute external tooling on user-provided targets.

Medium

templates/capture-workflow.sh:28

Shell command substitution

CLOSE_RESULT=$(infsh app run agent-browser --function close --session $SESSION_ID --input '{}' 2>/de

The active template captures output from infsh, jq, or related commands while driving a browser session. The commands are intended, but they execute external tooling on user-provided targets.

Medium

templates/capture-workflow.sh:31

Shell command substitution

VIDEO=$(echo $CLOSE_RESULT | jq -r '.video // empty')

The active template captures output from infsh, jq, or related commands while driving a browser session. The commands are intended, but they execute external tooling on user-provided targets.

Medium

templates/capture-workflow.sh:63

Shell command substitution

URL=$(echo $RESULT | jq -r '.url')

The active template captures output from infsh, jq, or related commands while driving a browser session. The commands are intended, but they execute external tooling on user-provided targets.

Medium

templates/capture-workflow.sh:64

Shell command substitution

TITLE=$(echo $RESULT | jq -r '.title')

The active template captures output from infsh, jq, or related commands while driving a browser session. The commands are intended, but they execute external tooling on user-provided targets.

Medium

templates/capture-workflow.sh:86

Shell command substitution

RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')

The active template captures output from infsh, jq, or related commands while driving a browser session. The commands are intended, but they execute external tooling on user-provided targets.

Medium

templates/capture-workflow.sh:105-107 templates/capture-workflow.sh:114-115

Shell command substitution · 2 occurrences

RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{

The active template captures output from infsh, jq, or related commands while driving a browser session. The commands are intended, but they execute external tooling on user-provided targets.

Low

SKILL.md:9

Hardcoded URL

Browser automation for AI agents via [inference.sh](https://inference.sh). Uses Playwright under the

The URL points to the external inference.sh or installation documentation dependency. It is expected, but users should know the skill relies on third-party network services.

Low

SKILL.md:11

Hardcoded URL

![Agentic Browser](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgjw8atdxgkrs

The URL points to the external inference.sh or installation documentation dependency. It is expected, but users should know the skill relies on third-party network services.

Low

SKILL.md:15

Hardcoded URL

> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer

The URL points to the external inference.sh or installation documentation dependency. It is expected, but users should know the skill relies on third-party network services.

Low

SKILL.md:283

Hardcoded URL

- [inference.sh Sessions](https://inference.sh/docs/extend/sessions) - Session management

The URL points to the external inference.sh or installation documentation dependency. It is expected, but users should know the skill relies on third-party network services.

Low

SKILL.md:284

Hardcoded URL

- [Multi-function Apps](https://inference.sh/docs/extend/multi-function-apps) - How functions work

The URL points to the external inference.sh or installation documentation dependency. It is expected, but users should know the skill relies on third-party network services.

Risk Factors

⚙️ External commands (163)

🌐 Network access (54)

📁 Filesystem access (15)

references/authentication.md:5 references/authentication.md:263 references/commands.md:3 references/commands.md:59 references/proxy-support.md:5 references/proxy-support.md:272 references/snapshot-refs.md:5 references/video-recording.md:5 references/video-recording.md:239 templates/authenticated-session.sh:30 templates/capture-workflow.sh:28 templates/capture-workflow.sh:78 templates/capture-workflow.sh:81 templates/capture-workflow.sh:149 templates/form-automation.sh:23

Detected Patterns

Screen capture upload

Audited by: codex

Audit version 2

Jun 30, 2026, 04:25 AM

Static command findings are mostly Markdown examples and expected shell templates, not hidden execution. However, the skill intentionally enables remote browser navigation, proxy routing, file upload, screenshots, video recording, JavaScript execution, and authenticated-session handling. Publication should require revisions that remove abuse-oriented proxy guidance, cookie extraction examples, and clearer consent controls.

Files scanned

2,108

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

references/authentication.md:209-224

Cookie and Session Data Extraction Guidance

The authentication documentation shows extracting document cookies and echoing them to logs. This can expose session tokens or authentication state from user accounts.

The reviewed lines show a cookie extraction workflow and print the result. The file also covers authenticated sessions, so the exposure risk is concrete.

Medium

SKILL.md:110-126 references/video-recording.md:189-210 references/video-recording.md:259-270

Screenshots and Video Can Capture Sensitive Data

The skill supports screenshots and session video, including examples for login, admin, and authenticated workflows. The documentation warns about sensitive recording, but the capability still needs strong marketplace warnings.

The recording capability is explicit and examples include admin or authenticated contexts. Existing warnings reduce but do not eliminate the risk.

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/proxy-support.md:85-128

Proxy Rotation for Rate Limit Avoidance

The proxy documentation explicitly describes rotating proxies for web scraping under a rate limit avoidance heading. This can enable abuse of third-party sites and should be removed or reframed as authorized testing only.

The heading and example directly describe proxy rotation for scraping. The intent is explicit enough to treat this as a confirmed high-risk marketplace issue.

Medium

SKILL.md:180-188 references/commands.md:162-176 templates/capture-workflow.sh:103-117

Arbitrary Browser JavaScript Execution

The skill documents an execute function that runs custom JavaScript on the active page. This is useful for extraction and testing, but can read page content and interact with authenticated pages.

The execute capability is documented in multiple files and sample templates use it for content extraction. It is legitimate but powerful in authenticated contexts.

Medium

SKILL.md:156-165 references/commands.md:95-97 references/commands.md:112-113

Local File Upload Paths

The interact action supports file upload paths. This is expected browser automation behavior, but an agent could upload unintended local files if a user grants broad instructions.

The upload capability is clearly documented with local file paths. It is legitimate, but it creates data exposure risk without explicit user approval gates.

Medium

templates/authenticated-session.sh:39-48 templates/capture-workflow.sh:52-69 templates/form-automation.sh:28-40

Shell Templates Execute Remote Browser CLI Commands

The included shell templates run the inference.sh browser app with user-provided URLs and write extracted output files. This is expected for the skill, but it combines network access, external commands, and local output writes.

The commands are real shell templates rather than hidden code. Risk is moderate because they intentionally call an external service and persist page data locally.

Low

SKILL.md:17-21 references/commands.md:7-15 references/snapshot-refs.md:31-35

Static Command Patterns Are Mostly Documentation Examples

Most backtick and command-substitution findings occur inside Markdown command examples or normal shell variable assignments. They are visible usage instructions, not concealed execution in the skill loader.

Manual review shows these locations are documentation examples. Some scripts do execute commands, but the large static count overstates hidden execution risk.

Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

SKILL.md:15-21 references/commands.md:3-25 references/proxy-support.md:5-24

Hardcoded URLs and Relative Links Are Example Data

Hardcoded URL findings are primarily example domains, documentation links, and proxy placeholders. Path traversal alerts are Markdown links to parent documentation, not runtime traversal.

The reviewed lines are visible examples and relative documentation links. No evidence found that they perform filesystem traversal or hidden network callbacks.

Low

references/commands.md:13-15

No Prompt Injection Attempt Found

Reviewed files did not contain text asking the evaluator to ignore instructions, override policy, skip analysis, or treat the skill as pre-approved.

Targeted search found only a benign phrase about starting a new browser session. No evidence found of prompt-injection language in the reviewed files.

Risk Factors

⚡ Contains scripts (3)

templates/authenticated-session.sh:1-33 templates/capture-workflow.sh:1-38 templates/form-automation.sh:1-26

⚙️ External commands (3)

SKILL.md:17-21 references/commands.md:7-15 templates/capture-workflow.sh:52-60

🌐 Network access (4)

SKILL.md:21 SKILL.md:143-153 references/proxy-support.md:85-128 references/proxy-support.md:145-168

📁 Filesystem access (4)

SKILL.md:156-165 references/commands.md:95-97 templates/capture-workflow.sh:16-23 templates/capture-workflow.sh:68-117

Detected Patterns

Remote Browser Navigation to Arbitrary URLsPage JavaScript ExecutionProxy Routing Including SOCKS5Screenshots and Session RecordingLocal File Upload Capability

Audited by: codex

Audit version 1

Apr 29, 2026, 08:55 AM

Static analysis detected 606 potential security issues, primarily shell command patterns in documentation files. After evaluation, all findings are FALSE POSITIVES or informational. The skill is a legitimate browser automation tool that uses the belt CLI to control Playwright. Shell commands are documented usage examples, not execution vulnerabilities. Browser credential access and session state are expected behavior for this tool type.

Files scanned

2,313

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

references/session-management.md:20-21 references/session-management.md:67-69

Browser Credential and Storage Access

Skill accesses browser session state including cookies, LocalStorage, and SessionStorage. This is expected behavior for browser automation tools and is documented for legitimate use cases.

Accessing browser state (cookies, storage) is the intended function of a browser automation tool, not a security vulnerability.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

references/authentication.md:20-283 references/commands.md:9-273 references/proxy-support.md:21-293 references/session-management.md:30-196 SKILL.md:9-273

Shell Command Usage in Documentation

501 shell command patterns detected in documentation files (authentication.md, commands.md, proxy-support.md, etc.). These are example commands showing how to use the belt CLI tool, not actual code execution vulnerabilities.

Documentation patterns flagged as shell commands are example usage for the belt CLI tool, not actual execution vulnerabilities. The skill delegates to a controlled CLI interface.

Medium

SKILL.md:9-15 references/authentication.md:25-194 references/proxy-support.md:23-259

Network Access for Browser Service

Skill communicates with inference.sh service for browser control. URLs in documentation are legitimate service endpoints.

Network access is to the inference.sh service for browser automation, not data exfiltration. All URLs are legitimate service endpoints.

Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Medium

references/authentication.md:5 references/commands.md:3-59 references/proxy-support.md:5

Path Traversal Patterns in Documentation

Path traversal patterns (../) found in documentation are relative paths for file references, not actual path traversal vulnerabilities.

These are relative paths in markdown documentation for linking between files, not filesystem vulnerabilities.

Risk Factors

⚙️ External commands (4)

SKILL.md:34-58 references/authentication.md:20-297 references/commands.md:9-273 templates/authenticated-session.sh:40-130

🌐 Network access (3)

SKILL.md:9-15 references/authentication.md:25-194 templates/authenticated-session.sh:118

📁 Filesystem access (2)

SKILL.md:3 templates/authenticated-session.sh:30

Audited by: claude

← Back to Skill