技能 browser-use
📦
browser-use
内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问
使用 Playwright MCP 自动化浏览器工作流
手动浏览器任务会拖慢测试、研究和数据采集。此技能将 Claude、Codex 或 Claude Code 连接到 Playwright MCP，以执行可重复的浏览器操作。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "browser-use" from https://skillstore.io/skills/abdullahmalik17-browser-use.md and its manifest at https://skillstore.io/api/skills/abdullahmalik17-browser-use/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“browser-use”。 打开产品页面并捕获其当前视觉状态。
预期结果:
浏览器会打开页面，等待内容加载，保存屏幕截图，并报告页面标题和可见区块。
正在使用“browser-use”。 使用提供的示例数据填写测试注册表单。
预期结果:
表单字段会被填写，提交按钮会被点击，并总结生成的确认消息。
正在使用“browser-use”。 从公共文档页面提取标题和可见链接。
预期结果:
响应会列出主标题、可见导航链接，以及页面上观察到的任何提取限制。
安全审计
高风险v9 • 2026/7/7 打开版本化报告
Most static hits in the generated reference documentation are false positives from Markdown backticks and JSON Schema URLs. Confirmed risks remain in the stdio subprocess path, shell lifecycle helpers, HTTP-capable MCP client requests, predictable /tmp PID files, and browser JavaScript execution guidance. No prompt injection text was found in the reviewed files.
5
已扫描文件
1,533
分析行数
21
复核项
0
已忽略误报
已确认安全问题 (2)
高
Arbitrary Browser JavaScript Execution
The skill documents browser_evaluate and browser_run_code for caller-supplied JavaScript and Playwright code. In an authenticated browser, this can read page content or perform unintended actions.
The referenced lines explicitly document executing supplied browser JavaScript or Playwright code. The risk depends on target page context, but the capability is direct and powerful.
中
Persistent Shared Browser Context
The skill requires shared browser context across MCP calls. This can retain cookies, logged-in state, and other session data longer than users expect.
The instructions state that shared browser context is required, and the start script enables it. Persistent state is intentional, but it is security-sensitive for authenticated sessions.
能力复核项 (21)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Python subprocess.Popen
self._process = subprocess.Popen(
subprocess.Popen is called with shell=True on the caller-provided --stdio command. This can execute arbitrary shell syntax if untrusted input reaches that option.
高
Ruby/shell backtick execution
```bash
The range documents browser_evaluate with caller-supplied JavaScript. In an active browser context, JavaScript can inspect or manipulate page state.
高
Ruby/shell backtick execution
For complex workflows, use `browser_run_code` to run multiple actions in one call:
The prose recommends browser_run_code for complex multi-step browser workflows. That tool runs supplied Playwright code and can perform powerful page actions.
高
Ruby/shell backtick execution
```bash
The range shows browser_run_code executing supplied Playwright code through the MCP client. This can perform arbitrary browser actions in the current page context.
中
Unix shell invocation
#!/bin/bash
This shell helper starts the Playwright MCP server through npx in the same script. It intentionally launches local processes and pulls an external package name.
中
Temp directory access
PID_FILE="/tmp/playwright-mcp-${PORT}.pid"
The script stores the server PID in a predictable /tmp path derived from the port. A local user could tamper with that file and affect lifecycle checks.
中
Shell command substitution
python3 "$(dirname "$0")/mcp-client.py" call -u "http://localhost:${PORT}" -t browser_close -p '{}'
The line invokes python3 to run the bundled MCP client before stopping the server. The dirname substitution is quoted, but this is still intentional external command execution.
中
Unix shell invocation
#!/bin/bash
This shell helper controls processes with kill and pkill in the same script. It is intended lifecycle management, but it is security relevant process control.
中
Temp directory access
PID_FILE="/tmp/playwright-mcp-${PORT}.pid"
The stop script trusts a predictable /tmp PID file to choose which process to signal. A tampered PID file could cause it to target an unintended process.
中
Ruby/shell backtick execution
```bash
This Markdown range instructs users or agents to run bash scripts and npx @playwright/mcp@latest. These are real local shell commands, even though the static pattern name is imprecise.
中
Ruby/shell backtick execution
```bash
This Markdown range instructs stopping the server with bash, python3, and pkill commands. Those commands intentionally execute local processes and signal matching processes.
中
Ruby/shell backtick execution
```bash
The range contains shell examples that call scripts/mcp-client.py for browser navigation. This is intended tooling, but it directs agents to execute local commands.
中
Ruby/shell backtick execution
```bash
The range contains shell examples that call the MCP client for snapshots and screenshots. It is legitimate documentation, but it still asks the agent to run local commands.
中
Ruby/shell backtick execution
```bash
The range contains shell commands for clicking, typing, filling forms, and selecting options. These commands can change live web pages and submit user data.
中
Ruby/shell backtick execution
```bash
The range contains shell examples that invoke the MCP client for wait operations. The action is low impact, but it still directs local command execution.
低
HTTP client library
def request(self, method: str, params: Optional[dict] = None) -> dict:
This request method builds and sends JSON-RPC calls through the HTTP transport. The destination is caller-controlled through --url, so the network capability is real.
低
HTTP client library
result = self.transport.request("tools/list")
The high-level client sends a tools/list request through the selected transport. When HTTP transport is selected, this is outbound network activity to a caller-provided MCP server.
低
HTTP client library
result = self.transport.request("tools/call", params)
The high-level client sends tools/call parameters through the selected transport. With HTTP transport, tool names and arguments are sent to the configured MCP endpoint.
低
HTTP client library
result = self.transport.request("resources/list")
The resource listing request is routed through the selected MCP transport. If HTTP is used, the request goes to the caller-provided server URL.
低
HTTP client library
result = self.transport.request("prompts/list")
The prompt listing request is routed through the selected MCP transport. If HTTP is used, the request goes to the caller-provided server URL.
低
Python HTTP libraries
from urllib.request import Request, urlopen
The client imports urllib.request and uses it for MCP HTTP transport. Network access is intended, but it is still a real capability that can contact caller-provided URLs.
风险因素
⚙️ 外部命令 (37)
references/playwright-tools.md:247 references/playwright-tools.md:308 references/playwright-tools.md:471-480 references/playwright-tools.md:515-533 scripts/mcp-client.py:191 scripts/mcp-client.py:204 scripts/mcp-client.py:348 scripts/mcp-client.py:371 scripts/mcp-client.py:377-379 scripts/start-server.sh:9 scripts/start-server.sh:10 scripts/start-server.sh:20 scripts/start-server.sh:21 scripts/start-server.sh:1 scripts/stop-server.sh:9 scripts/stop-server.sh:12 scripts/stop-server.sh:1 SKILL.md:13-19 SKILL.md:19-22 SKILL.md:22-29 SKILL.md:29-36 SKILL.md:36-42 SKILL.md:42-49 SKILL.md:49-53 SKILL.md:53-60 SKILL.md:60-64 SKILL.md:64-66 SKILL.md:66-82 SKILL.md:82-86 SKILL.md:86-94 SKILL.md:94-98 SKILL.md:98-101 SKILL.md:101-105 SKILL.md:105-107 SKILL.md:107-110 SKILL.md:110-112 SKILL.md:112-140
🌐 网络访问 (49)
references/playwright-tools.md:19 references/playwright-tools.md:56 references/playwright-tools.md:91 references/playwright-tools.md:127 references/playwright-tools.md:168 references/playwright-tools.md:199 references/playwright-tools.md:265 references/playwright-tools.md:284 references/playwright-tools.md:315 references/playwright-tools.md:368 references/playwright-tools.md:399 references/playwright-tools.md:418 references/playwright-tools.md:447 references/playwright-tools.md:478 references/playwright-tools.md:531 references/playwright-tools.md:559 references/playwright-tools.md:626 references/playwright-tools.md:675 references/playwright-tools.md:712 references/playwright-tools.md:758 references/playwright-tools.md:800 references/playwright-tools.md:838 scripts/mcp-client.py:146 scripts/mcp-client.py:271 scripts/mcp-client.py:314 scripts/mcp-client.py:323 scripts/mcp-client.py:328 scripts/mcp-client.py:333 scripts/mcp-client.py:33 scripts/mcp-client.py:10 scripts/mcp-client.py:16 scripts/mcp-client.py:20 scripts/mcp-client.py:23 scripts/stop-server.sh:12 SKILL.md:27 SKILL.md:44 SKILL.md:45 SKILL.md:48 SKILL.md:55 SKILL.md:58 SKILL.md:68 SKILL.md:72 SKILL.md:76 SKILL.md:80 SKILL.md:88 SKILL.md:92 SKILL.md:99 SKILL.md:108 SKILL.md:109
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/abdullahmalik17-browser-use/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/abdullahmalik17-browser-use?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/abdullahmalik17-browser-use?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/abdullahmalik17-browser-use/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/abdullahmalik17-browser-use.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
AbdullahMalik17. (2026). browser-use security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/abdullahmalik17-browser-use/audits/9BibTeX 引用
@techreport{abdullahmalik17-abdullahmalik17-browser-use-2026,
author = {AbdullahMalik17},
title = {browser-use security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/abdullahmalik17-browser-use/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "browser-use security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "AbdullahMalik17"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/abdullahmalik17-browser-use/audits/9"
identifiers:
- type: other
value: "skillstore:abdullahmalik17-browser-use:audit:9"
description: "Skillstore immutable audit report identifier"
比较变体
3 个可安装变体每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。
为什么此变体排名第一
证据置信度更高
作者 / 来源 Skillstore 评分 证据置信度 Skillstore 使用量 已更新
abdullahmalik17-browser-use
Skillstore 评分 38
证据置信度 中
Skillstore 使用量 12
已更新
2026-09-09
Skillstore 评分
评分依据 证据置信度: 中 64
架构
85
可维护性
87
内容
70
社区
83
规范符合性
你能构建什么
测试 Web 表单
在手动回归检查期间，自动完成表单填写、按钮点击、等待和屏幕截图。
收集页面证据
导航公共页面、捕获页面状态，并提取可见信息用于结构化笔记。
调试浏览器流程
在复现用户界面问题时，检查页面快照、控制台输出和网络行为。
试试这些提示
打开并检查页面
启动浏览器 MCP 服务器，打开目标 URL，捕获快照，并总结可见的页面区块。
捕获视觉状态
导航到页面，等待主内容可见，并使用清晰的文件名截取整页屏幕截图。
完成测试表单
使用页面快照查找表单字段，填写提供的测试值，提交表单，并报告确认状态。
运行多步骤浏览器任务
执行可信的多步骤 Playwright 工作流，捕获最终页面状态，并解释执行的每个浏览器操作。
最佳实践
- 使用可信 URL，并避免输入真实密钥，除非该页面已获批准。
- 在点击或输入前捕获快照，以确保元素引用是当前的。
- 浏览器工作完成后停止 MCP 服务器，以关闭活动会话。
避免
- 不要运行来自不可信提示或复制的网页内容的浏览器代码。
- 不要在超出已批准任务范围的网站上使用已认证账户。
- 不要将 MCP 客户端指向远程服务器，除非你信任该端点。
常见问题
此技能会自动化哪些内容？
它通过 Playwright MCP 自动化浏览器操作，包括导航、屏幕截图、表单输入、点击和页面检查。
它需要本地服务器吗？
是的。辅助脚本会启动本地 Playwright MCP 服务器，用于接收浏览器工具调用。
它可以浏览已认证的网站吗？
可以，但只能使用已批准的账户和可信站点，因为共享的浏览器上下文可能会保留会话状态。
它可以从页面中提取数据吗？
可以。它可以使用快照或可信的页面评估来收集可见页面数据。
它适合用于生产环境抓取吗？
与大规模抓取相比，它更适合辅助自动化、QA 检查和受控研究。
用户在使用前应审查哪些内容？
在运行自动化操作前，请审查辅助脚本、固定的包版本、目标 URL，以及任何浏览器代码。
开发者详情
许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
引用
9f22d902a4190b1e33cced8a68441beb8e612f59
维护新鲜度
2026/7/18
使用量
6 次下载 · 197 次浏览
文件结构