browser-use

ISSUES FOUND max severity HIGHSkillSpector Caution 12 registry skills.sh last scanned 2026-02-05 1 scan

5 findings (2 high, 3 medium), mainly command injection, data exfiltration, unauthorized tool use. Most recent scan 2026-02-05.

This browser automation skill presents MULTIPLE HIGH-SEVERITY security risks that require immediate attention. The primary concerns are: (1) Unrestricted bash command execution via wildcard pattern allowing arbitrary browser-use operations, (2) Explicit use of real browser mode exposing all user credentials and authenticated sessions, (3) Unpinned external package installation creating supply chain vulnerabilities, and (4) Lack of web content validation enabling indirect prompt injection attacks. The skill's design prioritizes functionality over security, with persistent sessions, no resource cleanup, and direct access to sensitive browser data. While browser automation is a legitimate use case, this implementation lacks essential security controls including input validation, session isolation, resource management, and content sanitization. The skill should NOT be used in its current form without significant security hardening, particularly removal of real browser mode access and implementation of strict command restrictions.
Scanner's overall assessment (LLM analyzer)

Findings5

Critical0

High2

Medium3

Low0

Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 12

Score12 / 100

Issues2

CategoriesMCP Rug Pull Rogue Agent

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, or extract information from web pages.

Package: 1 file, 8.7 KB
SKILL.md: 1080 words, 12+ sections
Code: None. Instructions only.
Allowed tools: Bash(browser-use:*)

SKILL.md covers: Browser Automation with browser-use CLI · Installation · Run without installing (recommended for one-off use) · Or install permanently · Install browser dependencies (Chromium) · Quick Start · Core Workflow · Browser Modes · Commands · Navigation · Page State · Interactions (use indices from `browser-use state`)

Findings

HIGH Arbitrary Command Execution via Bash Tool Command Injectionllm

The skill uses 'allowed-tools: Bash(browser-use:*)' which permits execution of arbitrary bash commands with the browser-use CLI. This creates a command injection risk where malicious instructions could manipulate browser-use arguments to execute unintended operations, access sensitive data, or perform unauthorized actions. The wildcard pattern 'browser-use:*' allows any browser-use subcommand without restriction.

SKILL.md

allowed-tools: Bash(browser-use:*)

Remediation: Restrict allowed-tools to specific browser-use subcommands needed for the skill's stated purpose. Use explicit command allowlists like 'Bash(browser-use:open)', 'Bash(browser-use:state)', 'Bash(browser-use:screenshot)' instead of wildcards. Implement input validation for URLs and user-provided text to prevent command injection.

HIGH Credential and Session Data Exposure via Real Browser Mode Data Exfiltrationllm

The skill documentation explicitly instructs use of '--browser real' mode, which accesses the user's actual Chrome browser with all cookies, extensions, and logged-in sessions. This creates a severe data exposure risk where the skill can access authenticated sessions to banking, email, social media, and other sensitive services. Any malicious instruction could leverage these active sessions to exfiltrate data or perform unauthorized actions.

SKILL.md

browser-use --browser real open <url>          # User's Chrome with login sessions
- **real**: Uses your Chrome with cookies, extensions, logged-in sessions

Remediation: Remove or strongly discourage the 'real' browser mode from skill instructions. Default to isolated 'chromium' mode only. Add explicit warnings about session exposure risks if real browser mode is necessary. Implement user confirmation prompts before accessing real browser sessions.

MEDIUM External Package Installation Without Version Pinning Unauthorized Tool Usellm

The skill instructs installation of the 'browser-use' package via 'uvx' and 'uv pip install' without specifying version constraints. This creates a supply chain risk where a compromised or malicious version of browser-use could be installed, potentially containing backdoors, data exfiltration code, or other malicious functionality. The lack of version pinning means the skill's behavior is non-deterministic and could change with package updates.

SKILL.md

uvx browser-use[cli] open https://example.com
uv pip install browser-use[cli]
browser-use install

Remediation: Pin browser-use to a specific, verified version (e.g., 'browser-use[cli]==1.2.3'). Include package hash verification. Document the verified version and update process. Consider bundling the browser-use package with the skill or using a vendored/verified copy.

MEDIUM Persistent Browser Session Without Cleanup Mechanism Resource Abusellm

The skill maintains persistent browser sessions across commands without documented cleanup, timeout, or resource management mechanisms. The instructions emphasize 'Browser stays open between commands' but provide no guidance on session lifecycle management. This could lead to resource exhaustion through accumulated browser processes, memory leaks, or orphaned browser instances consuming system resources indefinitely.

SKILL.md

5. **Repeat**: Browser stays open between commands

Remediation: Implement automatic session timeout and cleanup mechanisms. Add explicit session management commands and document when to close browsers. Include resource monitoring and limits. Provide clear guidance on using 'browser-use close' to terminate sessions. Consider implementing automatic cleanup after inactivity periods.

MEDIUM Transitive Trust Risk from Web Content Execution Prompt Injectionllm

The skill enables navigation to arbitrary URLs and interaction with web page content without validation or sandboxing. Malicious web pages could contain instructions or content designed to manipulate the agent's behavior through indirect prompt injection. The 'browser-use state' command extracts page elements that could contain adversarial prompts, and the skill provides no guidance on validating or sanitizing web content before processing.

SKILL.md

browser-use open <url>                    # Navigate to URL
browser-use state                         # Get URL, title, and clickable elements

Remediation: Implement URL allowlisting or validation before navigation. Add content sanitization for extracted page elements. Warn users about risks of navigating to untrusted sites. Consider implementing a content security policy that filters potentially malicious instructions from web page content before presenting to the agent.

What is in the package

File	Kind	Size
`SKILL.md`	doc	8.7 KB

External hosts referenced

gmail.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

BROWSER_USE_API_KEY

Package contents recorded 2026-10-22 at commit 43888b1b7e9f. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://github.com/browser-use/browser-use
Raw scan result: browser-use-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/skills-sh-browser-use.svg)
Request a re-scan

Second scanner: NVIDIA SkillSpector

What this skill does

Findings

What is in the package

External hosts referenced

Environment variables referenced

What we checked

What we did not check

Sources

Related skills