agent-browser

ISSUES FOUND max severity HIGHSkillSpector Caution 49 registry magentosh last scanned 2026-10-22 1 scan

10 findings (1 high, 7 medium, 1 low, 1 info), mainly data exfiltration, unauthorized tool use, policy violation. Most recent scan 2026-10-22.

This is a byte-identical copy of agent-browser from 101-skills, which is the primary page for this skill. Same SKILL.md, same files; each copy is scanned separately so divergence shows up here.

Findings10

Critical0

High1

Medium7

Low1

Analyzersstatic bytecode pipeline correlation behavioral trigger

Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictCaution 49

Score49 / 100

Issues5

CategoriesMCP Rug Pull analysis-evasion

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Browser automation for AI agents via inference.sh. Navigate web pages, interact with elements using @e refs, take screenshots, record video. Capabilities: web scraping, form filling, clicking, typing, drag-drop, file upload, JavaScript execution. Use for: web automation, data extraction, testing, agent browsing, research. Triggers: browser, web automation, scrape, navigate, click, fill form, screenshot, browse web, playwright, headless browser, web agent, surf internet, record video

Package: 10 files, 62 KB
SKILL.md: 1179 words, 12+ sections
Code: Shell (3)
Allowed tools: Bash(belt *)

SKILL.md covers: Agentic Browser · Quick Start · Open a page and get interactive elements · Core Workflow · 1. Start session · Elements: @e1 [input] "Email", @e2 [input] "Password", @e3 [button] "Sign In" · 2. Fill and submit · 3. Re-snapshot after navigation · 4. Close when done · Functions · Interact Actions · Element Refs

Findings

HIGH Code executes bash but Bash tool not in allowed-tools Unauthorized Tool Usestatic

Skill restricts tools to ['Bash(belt', '*)'] but code executes bash commands

SKILL.md

Remediation: Add 'Bash' to allowed-tools or remove bash execution from code

MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $SESSION_ID (line 60) flows to `sh` at line 76.

templates/capture-workflow.sh:76

infsh app run agent-browser --function interact --session $SESSION_ID --input '{

Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.

MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $SESSION_ID (line 60) flows to `sh` at line 79.

templates/capture-workflow.sh:79

infsh app run agent-browser --function interact --session $SESSION_ID --input '{

Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.

MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $SESSION_ID (line 60) flows to `sh` at line 86.

templates/capture-workflow.sh:86

RESULT=$(infsh app run agent-browser --function snapshot --session $SESSION_ID --input '{}')

Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.

MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $SESSION_ID (line 60) flows to `sh` at line 91.

templates/capture-workflow.sh:91

infsh app run agent-browser --function screenshot --session $SESSION_ID --input '{}' > "$OUTPUT_DIR/page-screenshot.json"

Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.

MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $SESSION_ID (line 60) flows to `sh` at line 97.

templates/capture-workflow.sh:97

infsh app run agent-browser --function screenshot --session $SESSION_ID --input '{

Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.

MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $SESSION_ID (line 60) flows to `sh` at line 105.

templates/capture-workflow.sh:105

RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{

Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.

MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $SESSION_ID (line 60) flows to `sh` at line 114.

templates/capture-workflow.sh:114

RESULT=$(infsh app run agent-browser --function execute --session $SESSION_ID --input '{

Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.

LOW Code uses search/grep patterns but Grep tool not in allowed-tools Unauthorized Tool Usestatic

Skill restricts tools to ['Bash(belt', '*)'] but code uses regex search patterns

SKILL.md

Remediation: Add 'Grep' to allowed-tools or remove regex search operations

INFO Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

What is in the package

File	Kind	Size
`SKILL.md`	doc	9.5 KB
`references/authentication.md`	doc	7.4 KB
`references/commands.md`	doc	6.4 KB
`references/proxy-support.md`	doc	6.7 KB
`references/session-management.md`	doc	4.9 KB
`references/snapshot-refs.md`	doc	6.3 KB
`references/video-recording.md`	doc	7.2 KB
`templates/authenticated-session.sh`	script	4.5 KB
`templates/capture-workflow.sh`	script	5.6 KB
`templates/form-automation.sh`	script	3.9 KB

External hosts referenced

inference.sh site.com httpbin.org cloud.inference.sh corpproxy.company.com external-vendor.com google.com mysite.com raw.githubusercontent.com site1.com site2.com whatismyip.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

SESSION_ID OUTPUT_DIR LOGIN_URL PASSWORD REGION APP_PASSWORD APP_USERNAME CI_ARTIFACTS_DIR FORM_URL PROXY_URL TARGET_URL TASK_ID CORP_PASS FORM_EMAIL GOOGLE_PASSWORD TEST_URL TOTP_SECRET URLS USERNAME

Package contents recorded 2026-10-22 at commit becc25649700. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Bytecode analyzer.
Pipeline analyzer.
Correlation analyzer.
Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://github.com/magentosh/superpowers
Raw scan result: magentosh-superpowers-tools-utilities-agent-browser-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/magentosh-agent-browser.svg)
Request a re-scan