{
  "skill_name": "browser-use",
  "skill_path": "/workspace/skills/browser-use-browser-use/skills/browser-use",
  "skill_directory": "/workspace/skills/browser-use-browser-use/skills/browser-use",
  "is_safe": false,
  "max_severity": "HIGH",
  "findings_count": 5,
  "findings": [
    {
      "id": "llm_finding_browser-use_0",
      "rule_id": "LLM_COMMAND_INJECTION",
      "category": "command_injection",
      "severity": "HIGH",
      "title": "Arbitrary Command Execution via Bash Tool",
      "description": "The skill uses 'allowed-tools: Bash(browser-use:*)' which permits execution of arbitrary bash commands with the browser-use CLI. This creates a command injection risk where malicious instructions could manipulate browser-use arguments to execute unintended operations, access sensitive data, or perform unauthorized actions. The wildcard pattern 'browser-use:*' allows any browser-use subcommand without restriction.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "allowed-tools: Bash(browser-use:*)",
      "remediation": "Restrict allowed-tools to specific browser-use subcommands needed for the skill's stated purpose. Use explicit command allowlists like 'Bash(browser-use:open)', 'Bash(browser-use:state)', 'Bash(browser-use:screenshot)' instead of wildcards. Implement input validation for URLs and user-provided text to prevent command injection.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This browser automation skill presents MULTIPLE HIGH-SEVERITY security risks that require immediate attention. The primary concerns are: (1) Unrestricted bash command execution via wildcard pattern allowing arbitrary browser-use operations, (2) Explicit use of real browser mode exposing all user credentials and authenticated sessions, (3) Unpinned external package installation creating supply chain vulnerabilities, and (4) Lack of web content validation enabling indirect prompt injection attacks. The skill's design prioritizes functionality over security, with persistent sessions, no resource cleanup, and direct access to sensitive browser data. While browser automation is a legitimate use case, this implementation lacks essential security controls including input validation, session isolation, resource management, and content sanitization. The skill should NOT be used in its current form without significant security hardening, particularly removal of real browser mode access and implementation of strict command restrictions.",
        "primary_threats": [
          "Command Injection",
          "Credential Exposure",
          "Supply Chain Risk",
          "Transitive Trust Abuse",
          "Resource Exhaustion"
        ],
        "aitech": "AITech-9.1",
        "aitech_name": "Model or Agentic System Manipulation",
        "aisubtech": "AISubtech-9.1.4",
        "aisubtech_name": "Injection Attacks (SQL, Command Execution, XSS)",
        "scanner_category": "INJECTION ATTACK",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The wildcard pattern is explicitly declared in the manifest and the documentation shows multiple dangerous subcommands (eval, python, run) that can execute arbitrary code. This is a real command injection vector.",
        "meta_exploitability": "Medium - Requires crafting malicious instructions that leverage dangerous subcommands, but the wildcard allows it",
        "meta_impact": "High - Arbitrary JavaScript and Python execution, autonomous AI agent tasks, potential for data exfiltration and system manipulation"
      }
    },
    {
      "id": "llm_finding_browser-use_1",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "HIGH",
      "title": "Credential and Session Data Exposure via Real Browser Mode",
      "description": "The skill documentation explicitly instructs use of '--browser real' mode, which accesses the user's actual Chrome browser with all cookies, extensions, and logged-in sessions. This creates a severe data exposure risk where the skill can access authenticated sessions to banking, email, social media, and other sensitive services. Any malicious instruction could leverage these active sessions to exfiltrate data or perform unauthorized actions.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "browser-use --browser real open <url>          # User's Chrome with login sessions\n- **real**: Uses your Chrome with cookies, extensions, logged-in sessions",
      "remediation": "Remove or strongly discourage the 'real' browser mode from skill instructions. Default to isolated 'chromium' mode only. Add explicit warnings about session exposure risks if real browser mode is necessary. Implement user confirmation prompts before accessing real browser sessions.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This browser automation skill presents MULTIPLE HIGH-SEVERITY security risks that require immediate attention. The primary concerns are: (1) Unrestricted bash command execution via wildcard pattern allowing arbitrary browser-use operations, (2) Explicit use of real browser mode exposing all user credentials and authenticated sessions, (3) Unpinned external package installation creating supply chain vulnerabilities, and (4) Lack of web content validation enabling indirect prompt injection attacks. The skill's design prioritizes functionality over security, with persistent sessions, no resource cleanup, and direct access to sensitive browser data. While browser automation is a legitimate use case, this implementation lacks essential security controls including input validation, session isolation, resource management, and content sanitization. The skill should NOT be used in its current form without significant security hardening, particularly removal of real browser mode access and implementation of strict command restrictions.",
        "primary_threats": [
          "Command Injection",
          "Credential Exposure",
          "Supply Chain Risk",
          "Transitive Trust Abuse",
          "Resource Exhaustion"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The skill documentation explicitly instructs using real browser mode with access to all user credentials and sessions. This is a documented feature, not a false positive. The risk is clear and severe.",
        "meta_exploitability": "Easy - Single command flag '--browser real' grants immediate access to all authenticated sessions",
        "meta_impact": "Critical - Full access to banking, email, social media, and all logged-in services. Potential for financial fraud, identity theft, and complete account compromise."
      }
    },
    {
      "id": "llm_finding_browser-use_2",
      "rule_id": "LLM_UNAUTHORIZED_TOOL_USE",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "External Package Installation Without Version Pinning",
      "description": "The skill instructs installation of the 'browser-use' package via 'uvx' and 'uv pip install' without specifying version constraints. This creates a supply chain risk where a compromised or malicious version of browser-use could be installed, potentially containing backdoors, data exfiltration code, or other malicious functionality. The lack of version pinning means the skill's behavior is non-deterministic and could change with package updates.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "uvx browser-use[cli] open https://example.com\nuv pip install browser-use[cli]\nbrowser-use install",
      "remediation": "Pin browser-use to a specific, verified version (e.g., 'browser-use[cli]==1.2.3'). Include package hash verification. Document the verified version and update process. Consider bundling the browser-use package with the skill or using a vendored/verified copy.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This browser automation skill presents MULTIPLE HIGH-SEVERITY security risks that require immediate attention. The primary concerns are: (1) Unrestricted bash command execution via wildcard pattern allowing arbitrary browser-use operations, (2) Explicit use of real browser mode exposing all user credentials and authenticated sessions, (3) Unpinned external package installation creating supply chain vulnerabilities, and (4) Lack of web content validation enabling indirect prompt injection attacks. The skill's design prioritizes functionality over security, with persistent sessions, no resource cleanup, and direct access to sensitive browser data. While browser automation is a legitimate use case, this implementation lacks essential security controls including input validation, session isolation, resource management, and content sanitization. The skill should NOT be used in its current form without significant security hardening, particularly removal of real browser mode access and implementation of strict command restrictions.",
        "primary_threats": [
          "Command Injection",
          "Credential Exposure",
          "Supply Chain Risk",
          "Transitive Trust Abuse",
          "Resource Exhaustion"
        ],
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "aisubtech": "AISubtech-12.1.2",
        "aisubtech_name": "Tool Poisoning",
        "scanner_category": "SUSPICIOUS CODE EXECUTION",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "This is a real supply chain risk, but it's partially mitigated by uvx's ephemeral execution model. The risk is real but lower than if the package were permanently installed without isolation.",
        "meta_exploitability": "Low - Requires attacker to compromise the browser-use package on PyPI, which is difficult",
        "meta_impact": "High - If compromised, could lead to arbitrary code execution, but likelihood is low"
      }
    },
    {
      "id": "llm_finding_browser-use_3",
      "rule_id": "LLM_RESOURCE_ABUSE",
      "category": "resource_abuse",
      "severity": "MEDIUM",
      "title": "Persistent Browser Session Without Cleanup Mechanism",
      "description": "The skill maintains persistent browser sessions across commands without documented cleanup, timeout, or resource management mechanisms. The instructions emphasize 'Browser stays open between commands' but provide no guidance on session lifecycle management. This could lead to resource exhaustion through accumulated browser processes, memory leaks, or orphaned browser instances consuming system resources indefinitely.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "5. **Repeat**: Browser stays open between commands",
      "remediation": "Implement automatic session timeout and cleanup mechanisms. Add explicit session management commands and document when to close browsers. Include resource monitoring and limits. Provide clear guidance on using 'browser-use close' to terminate sessions. Consider implementing automatic cleanup after inactivity periods.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This browser automation skill presents MULTIPLE HIGH-SEVERITY security risks that require immediate attention. The primary concerns are: (1) Unrestricted bash command execution via wildcard pattern allowing arbitrary browser-use operations, (2) Explicit use of real browser mode exposing all user credentials and authenticated sessions, (3) Unpinned external package installation creating supply chain vulnerabilities, and (4) Lack of web content validation enabling indirect prompt injection attacks. The skill's design prioritizes functionality over security, with persistent sessions, no resource cleanup, and direct access to sensitive browser data. While browser automation is a legitimate use case, this implementation lacks essential security controls including input validation, session isolation, resource management, and content sanitization. The skill should NOT be used in its current form without significant security hardening, particularly removal of real browser mode access and implementation of strict command restrictions.",
        "primary_threats": [
          "Command Injection",
          "Credential Exposure",
          "Supply Chain Risk",
          "Transitive Trust Abuse",
          "Resource Exhaustion"
        ],
        "aitech": "AITech-13.3",
        "aitech_name": "Availability Disruption",
        "aisubtech": "AISubtech-13.3.2",
        "aisubtech_name": "Compute Exhaustion",
        "scanner_category": "RESOURCE ABUSE",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "The skill does provide cleanup commands and documentation. The issue is lack of enforcement, but this is more of a resource management concern than a security threat. Users have the tools to manage sessions properly.",
        "meta_exploitability": "N/A - This is a resource management issue, not an exploitable vulnerability",
        "meta_impact": "Low - Could lead to resource exhaustion over time, but requires user neglect and is easily resolved"
      }
    },
    {
      "id": "llm_finding_browser-use_4",
      "rule_id": "LLM_PROMPT_INJECTION",
      "category": "prompt_injection",
      "severity": "MEDIUM",
      "title": "Transitive Trust Risk from Web Content Execution",
      "description": "The skill enables navigation to arbitrary URLs and interaction with web page content without validation or sandboxing. Malicious web pages could contain instructions or content designed to manipulate the agent's behavior through indirect prompt injection. The 'browser-use state' command extracts page elements that could contain adversarial prompts, and the skill provides no guidance on validating or sanitizing web content before processing.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "browser-use open <url>                    # Navigate to URL\nbrowser-use state                         # Get URL, title, and clickable elements",
      "remediation": "Implement URL allowlisting or validation before navigation. Add content sanitization for extracted page elements. Warn users about risks of navigating to untrusted sites. Consider implementing a content security policy that filters potentially malicious instructions from web page content before presenting to the agent.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This browser automation skill presents MULTIPLE HIGH-SEVERITY security risks that require immediate attention. The primary concerns are: (1) Unrestricted bash command execution via wildcard pattern allowing arbitrary browser-use operations, (2) Explicit use of real browser mode exposing all user credentials and authenticated sessions, (3) Unpinned external package installation creating supply chain vulnerabilities, and (4) Lack of web content validation enabling indirect prompt injection attacks. The skill's design prioritizes functionality over security, with persistent sessions, no resource cleanup, and direct access to sensitive browser data. While browser automation is a legitimate use case, this implementation lacks essential security controls including input validation, session isolation, resource management, and content sanitization. The skill should NOT be used in its current form without significant security hardening, particularly removal of real browser mode access and implementation of strict command restrictions.",
        "primary_threats": [
          "Command Injection",
          "Credential Exposure",
          "Supply Chain Risk",
          "Transitive Trust Abuse",
          "Resource Exhaustion"
        ],
        "aitech": "AITech-1.2",
        "aitech_name": "Indirect Prompt Injection",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "PROMPT INJECTION",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "This is a real transitive trust risk inherent to browser automation, but exploitation requires a sophisticated attack where the user is tricked into visiting a malicious page. The risk is real but requires specific conditions.",
        "meta_exploitability": "Medium - Requires user to navigate to attacker-controlled page, then attacker must craft content that successfully manipulates agent behavior",
        "meta_impact": "Medium - Could lead to unintended actions, data disclosure, or further exploitation depending on agent's capabilities"
      }
    }
  ],
  "scan_duration_seconds": 39.80050086975098,
  "duration_ms": 39800,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-05T21:00:11.894744"
}