Versioned security assessment

Report ID: SA-4121DE96

8/6/2026, 11:32:40 AM

agent-browser security assessment v5

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
agent-browser
Version
v5
Maintainer
infsh-skills
Source
github.com/infsh-skills/skills/tree/main/tools/utilities/agent-browser/
Coverage
10 Files scanned · 2,315 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

5 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static hits are false positives caused by Markdown syntax, fenced shell examples, placeholder URLs, relative links, and /dev/null redirection. Confirmed risks include external installation, remote image loading, TOTP exposure through process arguments, and remote screen capture. Credential submission, cookie extraction, local file upload, and page JavaScript require explicit consent and strict scoping.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

10 Files scanned · 2,315 Lines analyzed

8 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 50 evidence locations

Filesystem access

May read or write local files.

Observed in 17 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 51 evidence locations

Capability review items (3)
Medium
references/authentication.md:133
Shell command substitution
TOTP_CODE=$(oathtool --totp -b "$TOTP_SECRET")
The example passes TOTP_SECRET to oathtool as a command-line argument. Other local users or process-monitoring tools may observe the secret.
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Although Markdown backticks do not execute code, this line explicitly directs users to run npx and install an external skill. That creates a real supply-chain execution boundary.
Low
SKILL.md:13
Hardcoded URL
![Agentic Browser](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgjw8atdxgkrs
This Markdown image loads from cloud.inference.sh when rendered. The request discloses viewer network metadata to an external host and depends on mutable remote content.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (5)

RISK-001 High
SKILL.md:3
Screen capture upload
description: "Browser automation for AI agents via inference.sh. Navigate web pages, interact with e
The declared capability captures screenshots and videos through the inference.sh service. Captured pages may contain credentials, personal data, or authenticated content sent to remote infrastructure.
RISK-002 High
SKILL.md:11references/authentication.md:31-38references/authentication.md:99-102references/authentication.md:131-138
Credentials Sent Through Remote Browser Commands
Authentication examples submit passwords and TOTP codes through inference.sh browser commands, exposing secrets to a third-party execution boundary.
The cited commands explicitly place password and TOTP values into interactions handled by the inference.sh browser service.
RISK-003 High
references/authentication.md:209-219
Session Cookie Disclosure
The authentication guide extracts document.cookie from an authenticated page and prints the result, which can expose reusable session credentials in logs.
The guide explicitly evaluates document.cookie, stores the result, and echoes it under the Cookies label.
RISK-004 High
SKILL.md:158-167
Local File Disclosure Through Upload
The upload action accepts local file paths and sends those files through the remote browser to a website without an explicit confirmation requirement.
The example directly supplies an absolute local file path to the upload action, and the skill states that execution occurs through inference.sh.
RISK-005 Medium
SKILL.md:182-190
Arbitrary Page JavaScript Execution
The skill exposes page-context JavaScript execution, which can read sensitive page data or trigger state changes beyond element-based interactions.
The documented execute function accepts custom JavaScript and returns its result, establishing direct page-context code execution.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Authentication examples transmit secrets through a remote browser service.
    Require explicit consent before authentication, recommend disposable test accounts, and state clearly that credentials and TOTP values cross the inference.sh boundary.
  2. FIX-002
    High
    The guide extracts and prints session cookies.
    Remove the cookie logging example, redact sensitive values, and prevent cookies or tokens from entering command output and retained logs.
  3. FIX-003
    High
    File upload and page JavaScript can disclose data or perform broad actions.
    Add domain and path allowlists, show the exact target and file before upload, and require confirmation before JavaScript execution.
  4. FIX-004
    High
    Screenshots, videos, and remote assets create privacy and integrity exposure.
    Disable recording by default, warn before capturing authenticated pages, redact sensitive fields, and replace mutable remote assets with reviewed local copies.
  5. FIX-005
    Medium
    The skill instructs users to install an external CLI skill with npx.
    Pin the dependency to a reviewed version or commit and document its publisher, permissions, and integrity verification steps.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
4121de961d1b6f2ffca856260e239505c302452c
Content hash
433ed471ceca49f696ba72856894860594a5dccbcac82da61797ae7a3a3ebfef
Tree hash
9217592db0c540dbb41db26b2a752f111a2b3008d156a9cfe4edc7f56b71639d
Skill path
skills/infsh-skills/agent-browser
Audit payload hash
b791494ef1dc10bbc4300da35ce72e7d

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active