browse

Detects dangerous code execution patterns in agent skills (Python/Bash): eval(selector, els => els.map(el => el.textContent)

SKILL.md:246

const data = await page.$$eval(selector, els =>

The skill requires BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID environment variables and instructs users to run 'stagehand fn auth login' which stores credentials in ~/.stagehand/config.json. The workflow then copies these credentials to .env files in project directories. This creates multiple copies of sensitive credentials across the filesystem, increasing exposure risk. Additionally, the skill does not provide guidance on securing these credentials or cleaning them up after use.

SKILL.md

```yaml
requires:
  env: ['BROWSERBASE_API_KEY', 'BROWSERBASE_PROJECT_ID']
```

```bash
stagehand fn auth login   # Stores in ~/.stagehand/config.json
# Later copied to .env files in each project
```

The skill demonstrates using page.evaluate() to execute arbitrary JavaScript in the browser context without input validation or sandboxing guidance. The example shows 'Complex extraction logic' as a placeholder, which could lead users to implement unsafe code execution patterns. Combined with user-controlled parameters (params object), this creates a code injection risk if users pass unsanitized input directly into evaluate() calls.

SKILL.md

```typescript
const data = await page.evaluate(() => {
  // Complex extraction logic
  r
```

The code snippet is incomplete but demonstrates evaluate() usage without security guidance. Users may implement: `page.evaluate(params.userCode)` leading to arbitrary code execution.

The skill explicitly instructs users to change dependency versions from 'latest' to caret ranges (^0.0.5, ^1.58.0) in the package.json fix. While this is better than 'latest', caret ranges still allow automatic minor/patch updates that could introduce malicious code or breaking changes. For security-critical browser automation with credential access, this creates supply chain attack surface. The skill also references '@browserbasehq/sdk-functions' version ^0.0.5 which is a pre-1.0 package with unstable API guarantees.

SKILL.md

```json
"dependencies": {
  "@browserbasehq/sdk-functions": "^0.0.5",
  "playwright-core": "^1.58.0"
}
```

Caret (^) allows: 0.0.5 → 0.0.x updates, 1.58.0 → 1.x.x updates. Pre-1.0 versions are particularly unstable.