Skip to content
skillsafebeta
← Report library
Purpose / Browser automation

Multi Account Isolation Skill Security Audit

What the author says it does (original text)

Verify that browser profiles are actually isolated from one another instead of assuming it - confirm each profile's timezone agrees with its own exit IP, that WebRTC exposes only the proxy, that canvas and WebGL hashes stay identical across relaunches of one profile, and that no two profiles share a persona, a cookie jar, or an address. Use when several of your own accounts or test identities run

Independent security check

Do not install or run it yet

Files checked
1
Risks found
6
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The unpinned npx command can execute package code published later

Source references: 1
What we found

The checklist recommends running `npx liarjs` in CI without a package version or integrity value. When the package is not already available locally, npx commonly fetches and executes the version currently resolved by the registry, so a future update, publisher-account compromise, or dependency compromise could change the executed code.

Why this matters

Compromised package code would run with the developer or CI job's permissions and could read the workspace, environment variables, and CI credentials or alter build artifacts.

`npx liarjs` is an active command intended for unattended CI, with no version or integrity pin. If the package is not already installed, npx commonly obtains and executes the currently resolved registry version; an update or supply-chain compromise could therefore change the code and expose files or credentials available to CI. Users can require a pinned dependency and restrict this step's network and credential access.

SKILL.md:85In the instructionsOpen original file
| 10 | Whole-stack coherence | [whoer.net](https://whoer.net), [pixelscan.net](https://pixelscan.net) | IP, timezone and locale disagree at a glance || 11 | Consistency rules in CI | `npx liarjs` ([liarjs.dev](https://liarjs.dev)) | Any of ~40 open-source cross-layer rules fail - this is the one that runs unattended |Checks 1, 3 and 7 are the ones worth wiring into CI: they are cheap, deterministic, and they catch the defects that actually recur.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 3
High risk

A closed-source runtime handles logged-in sessions and proxy credentials and requires license-server access

Source references: 4
What we found

The document states that a tool driving logged-in sessions receives cookies and proxy credentials, that proxy credentials are passed to a closed-source kernel, and that the API key is exchanged with antibrow.com roughly daily. The kernel has no offline mode, so network-isolated operation is unsupported. The supplied material does not independently verify how the kernel handles or retains these secrets.

Why this matters

If the runtime, licensing service, update chain, or host is compromised, login cookies, proxy credentials, or the API key could be abused, putting accounts and paid proxy resources at risk.

The document says a closed-source kernel handles proxy URLs and credentials, while the API key is exchanged with antibrow.com and no offline mode exists. Logged-in cookies and state are also stored in local profile directories. Use therefore entrusts valuable secrets to a component that cannot be independently inspected from the supplied source and requires outbound contact. Users can use dedicated low-privilege credentials, monitor egress, and request retention, encryption, and audit details.

SKILL.md:101In the instructionsOpen original file
Any tool that drives logged-in sessions receives cookies and proxy credentials, so it is fair to ask what it does with them. For antibrow:| Artifact | Where it lives | Who sees it ||---|---|---|| Cookies, `localStorage`, login state | `~/.anti-detect-browser/profiles/<id>/user-data/` on your disk, or `profiles-temp/<id>/` for a temporary profile | Local. Cloud sync is opt-in per profile: a launch never creates a cloud profile by itself, and `sync: true` is what puts one there. Check which profiles sync before assuming they stay on the machine || Persona (`persona.json`) | same profile directory, written once and frozen | Local || Profile identity record (`profile.json`) | same profile directory; the id it holds is what names the directory | Local. It is why a rename does not cost a persona, and why the folder name is not the profile name || Proxy URL and its credentials | passed to the kernel at launch; answered in the network stack (HTTP 407 / SOCKS5 RFC 1929) so no extension holds them | The kernel process and your proxy provider || API key | your environment, or `~/.antibrow/license.key` | Exchanged with `antibrow.com` for a short-lived license token, roughly once a day |
Show 3 other places
SKILL.md:111In the instructionsOpen original file
The kernel is a closed-source Chromium build - that is the tradeoff for the spoofing living in C++ rather than in an injectable script - so verify behaviour rather than take it on faith:
SKILL.md:121In the instructionsOpen original file
Point it at a proxy whose logs you can read, or at a local MITM proxy, and watch what leaves the machine during a launch. Pin the SDK version and check the published hash (`npm view anti-detect-browser@2.8.0 dist.integrity`) so the code you audited is the code that runs. If a deployment must not phone home at all, this is the wrong tool: license verification is compiled into the kernel and there is no offline mode.
SKILL.md:105In the instructionsOpen original file
|---|---|---|| Cookies, `localStorage`, login state | `~/.anti-detect-browser/profiles/<id>/user-data/` on your disk, or `profiles-temp/<id>/` for a temporary profile | Local. Cloud sync is opt-in per profile: a launch never creates a cloud profile by itself, and `sync: true` is what puts one there. Check which profiles sync before assuming they stay on the machine || Persona (`persona.json`) | same profile directory, written once and frozen | Local || Profile identity record (`profile.json`) | same profile directory; the id it holds is what names the directory | Local. It is why a rename does not cost a persona, and why the folder name is not the profile name || Proxy URL and its credentials | passed to the kernel at launch; answered in the network stack (HTTP 407 / SOCKS5 RFC 1929) so no extension holds them | The kernel process and your proxy provider || API key | your environment, or `~/.antibrow/license.key` | Exchanged with `antibrow.com` for a short-lived license token, roughly once a day |
High risk

Enabling cloud sync moves reusable login state off the machine

Source references: 1
What we found

The artifact table says cookies, localStorage, and login state reside in the profile directory, but `sync: true` puts a profile in the cloud. Such state can include reusable session tokens, while the supplied material does not describe cloud encryption, access controls, retention, or deletion.

Why this matters

A compromise of the cloud account, vendor systems, or sync permissions could expose session state and enable account takeover. Accidental synchronization can also violate local-storage or data-residency expectations.

The material explicitly says the profile contains cookies, localStorage, and login state, and that `sync: true` puts the profile in the cloud. Login state can include reusable session data, so enabling this option broadens the impact of disclosure or unauthorized access. No cloud safeguards are described here; users can leave sync disabled or first obtain details on encryption, access control, retention, deletion, and account recovery.

SKILL.md:105In the instructionsOpen original file
|---|---|---|| Cookies, `localStorage`, login state | `~/.anti-detect-browser/profiles/<id>/user-data/` on your disk, or `profiles-temp/<id>/` for a temporary profile | Local. Cloud sync is opt-in per profile: a launch never creates a cloud profile by itself, and `sync: true` is what puts one there. Check which profiles sync before assuming they stay on the machine || Persona (`persona.json`) | same profile directory, written once and frozen | Local |
Medium risk

External test sites receive the profile's IP and identifying fingerprint signals

Source references: 2
What we found

The Skill directs users to browserleaks, CreepJS, whoer, and pixelscan to test WebRTC, canvas, GPU, IP, timezone, and locale. Performing those tests necessarily connects to those sites and exposes the network address and browser surfaces required by the test.

Why this matters

Those services can observe the test time, exit IP, and relatively stable browser characteristics. If a live-account profile is used, these observations can create another source of linkable data.

The workflow actively directs profiles to several third-party detection sites. Those sites will at least observe the exit IP and run tests over WebRTC, worker properties, GPU, timezone, locale, and related fingerprint surfaces, potentially allowing the test profile to be logged or correlated. Users can limit testing to approved sites, use isolated test identities, or ask for locally hosted alternatives.

SKILL.md:76In the instructionsOpen original file
| 1 | Timezone matches the exit IP | `browser.timezone` vs the country of `browser.public_ip` | `geoip` was disabled, or `timezone` was forced to something the IP contradicts. This is the single most common defect. || 2 | WebRTC exposes only the proxy | [browserleaks.com/webrtc](https://browserleaks.com/webrtc) | ICE candidates still carry a local or real public address || 3 | Canvas hash is stable across launches | Read it, close, relaunch the same profile, read again | The two reads differ - a value that changes every read is itself an anomaly, and it means the persona is not frozen || 4 | Worker and main thread agree | [CreepJS](https://abrahamjuliot.github.io/creepjs/) | UA, `languages`, `hardwareConcurrency`, timezone or GPU differ when re-read inside a Web Worker || 5 | One GPU across three interfaces | CreepJS, or read WebGL / WebGL2 / WebGPU directly | `adapter.info.vendor` does not match the unmasked WebGL renderer family || 6 | No two profiles share a persona | Diff `browser.persona` across the fleet | Two profiles report the same UA, screen geometry and seeds || 7 | No two profiles share an address | Collect `browser.public_ip` for the fleet | Two identities came out of the same exit, or the same /24 || 8 | Cookie jars are separate | Compare `browser.profile_dir` across the fleet, then inspect `user-data/` inside each | Two identities resolve to one directory, or one directory holds state belonging to another identity || 9 | One identity, one profile tree | Confirm every launch of a name passes the same `temporary` value | A managed `gmail` and a temporary `gmail` are two different profiles with two personas and two cookie jars. A script that disagrees with itself about `temporary` is running two identities under one name and will look like a logged-out session, not like a bug || 10 | Whole-stack coherence | [whoer.net](https://whoer.net), [pixelscan.net](https://pixelscan.net) | IP, timezone and locale disagree at a glance || 11 | Consistency rules in CI | `npx liarjs` ([liarjs.dev](https://liarjs.dev)) | Any of ~40 open-source cross-layer rules fail - this is the one that runs unattended |
Show 1 other places
SKILL.md:84In the instructionsOpen original file
| 9 | One identity, one profile tree | Confirm every launch of a name passes the same `temporary` value | A managed `gmail` and a temporary `gmail` are two different profiles with two personas and two cookie jars. A script that disagrees with itself about `temporary` is running two identities under one name and will look like a logged-out session, not like a bug || 10 | Whole-stack coherence | [whoer.net](https://whoer.net), [pixelscan.net](https://pixelscan.net) | IP, timezone and locale disagree at a glance || 11 | Consistency rules in CI | `npx liarjs` ([liarjs.dev](https://liarjs.dev)) | Any of ~40 open-source cross-layer rules fail - this is the one that runs unattended |
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
High risk

The workflow can strengthen unlinkability between multiple accounts

Source references: 3
What we found

It goes beyond ordinary privacy isolation by requiring separate personas, proxies, addresses, and cookie directories, then testing whether those distinctions survive detection suites. These steps can reduce a platform's ability to associate accounts through browser and network signals. The authorized-use warning limits the stated purpose but does not technically prevent use against a platform's anti-fraud or enforcement systems.

Why this matters

Unauthorized use with real platform accounts could conceal common control and lead to account suspension, frozen funds, client losses, or legal and compliance consequences.

This is explicitly a cross-identity unlinkability workflow: each identity gets a separate profile, persona, proxy, and timezone, with checks against shared personas or addresses. Even though the document limits use to owned or authorized accounts, the procedure can reduce a platform's ability to correlate accounts through browser and network signals. Users should confirm account authorization and platform terms and ask how misuse against platform enforcement is constrained.

SKILL.md:19In the instructionsOpen original file
One identity gets one of everything. Any cell shared between two identities is a defect to find:```identity  →  profile  →  persona  →  proxy  →  timezone   1      :     1     :     1     :    1    :     1```Profiles are unlimited and free on every antibrow plan, so there is never a reason to reuse one. "Log out and log back in as the other identity" inside one profile defeats the entire setup - the cookie jar and `localStorage` are the point.
Show 2 other places
SKILL.md:80In the instructionsOpen original file
| 5 | One GPU across three interfaces | CreepJS, or read WebGL / WebGL2 / WebGPU directly | `adapter.info.vendor` does not match the unmasked WebGL renderer family || 6 | No two profiles share a persona | Diff `browser.persona` across the fleet | Two profiles report the same UA, screen geometry and seeds || 7 | No two profiles share an address | Collect `browser.public_ip` for the fleet | Two identities came out of the same exit, or the same /24 || 8 | Cookie jars are separate | Compare `browser.profile_dir` across the fleet, then inspect `user-data/` inside each | Two identities resolve to one directory, or one directory holds state belonging to another identity || 9 | One identity, one profile tree | Confirm every launch of a name passes the same `temporary` value | A managed `gmail` and a temporary `gmail` are two different profiles with two personas and two cookie jars. A script that disagrees with itself about `temporary` is running two identities under one name and will look like a logged-out session, not like a bug |
SKILL.md:136In the instructionsOpen original file
**Intended:** verifying isolation between identities you own; running client accounts with the account holder's authorization; building QA fixtures that emulate distinct devices; testing your own anti-fraud and correlation logic; auditing what a browser runtime does with your credentials.**Out of scope, and not supported:** accessing any system without authorization; logging into accounts that are not yours; credential stuffing or account takeover; creating fake accounts, reviews or engagement; circumventing an authentication, payment or authorization control; scraping personal data in violation of applicable law; working around a platform's enforcement decision.Complying with the terms of the platforms being used, and with applicable law, is the operator's responsibility. Report abuse or a security issue via the contact at `https://antibrow.com`.
Low risk

The install command does not pin a dependency version

Source references: 1
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

This is a CI check command rather than a normal installation instruction, but `npx liarjs` has no pinned version or integrity value. If the package is absent locally, npx may fetch and execute whatever version resolves at that time, so future runs can differ from the audited content. Users can ask for a pinned version and lockfile and run it in a restricted CI environment.

SKILL.md:85In the instructionsOpen original file
| 10 | Whole-stack coherence | [whoer.net](https://whoer.net), [pixelscan.net](https://pixelscan.net) | IP, timezone and locale disagree at a glance || 11 | Consistency rules in CI | `npx liarjs` ([liarjs.dev](https://liarjs.dev)) | Any of ~40 open-source cross-layer rules fail - this is the one that runs unattended |
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill is an anti-detect browser isolation checklist. It assigns each identity a separate profile, persona, proxy, and timezone, and warns against switching identities within one profile.

View source
SKILL.md:19In the instructionsOpen original file
One identity gets one of everything. Any cell shared between two identities is a defect to find:```identity  →  profile  →  persona  →  proxy  →  timezone   1      :     1     :     1     :    1    :     1```Profiles are unlimited and free on every antibrow plan, so there is never a reason to reuse one. "Log out and log back in as the other identity" inside one profile defeats the entire setup - the cookie jar and `localStorage` are the point.

The checks compare exit IPs, WebRTC, canvas, GPU, personas, addresses, and cookie directories, with selected checks recommended for CI.

View source
SKILL.md:75In the instructionsOpen original file
|---|---|---|---|| 1 | Timezone matches the exit IP | `browser.timezone` vs the country of `browser.public_ip` | `geoip` was disabled, or `timezone` was forced to something the IP contradicts. This is the single most common defect. || 2 | WebRTC exposes only the proxy | [browserleaks.com/webrtc](https://browserleaks.com/webrtc) | ICE candidates still carry a local or real public address || 3 | Canvas hash is stable across launches | Read it, close, relaunch the same profile, read again | The two reads differ - a value that changes every read is itself an anomaly, and it means the persona is not frozen || 4 | Worker and main thread agree | [CreepJS](https://abrahamjuliot.github.io/creepjs/) | UA, `languages`, `hardwareConcurrency`, timezone or GPU differ when re-read inside a Web Worker || 5 | One GPU across three interfaces | CreepJS, or read WebGL / WebGL2 / WebGPU directly | `adapter.info.vendor` does not match the unmasked WebGL renderer family || 6 | No two profiles share a persona | Diff `browser.persona` across the fleet | Two profiles report the same UA, screen geometry and seeds || 7 | No two profiles share an address | Collect `browser.public_ip` for the fleet | Two identities came out of the same exit, or the same /24 || 8 | Cookie jars are separate | Compare `browser.profile_dir` across the fleet, then inspect `user-data/` inside each | Two identities resolve to one directory, or one directory holds state belonging to another identity || 9 | One identity, one profile tree | Confirm every launch of a name passes the same `temporary` value | A managed `gmail` and a temporary `gmail` are two different profiles with two personas and two cookie jars. A script that disagrees with itself about `temporary` is running two identities under one name and will look like a logged-out session, not like a bug || 10 | Whole-stack coherence | [whoer.net](https://whoer.net), [pixelscan.net](https://pixelscan.net) | IP, timezone and locale disagree at a glance || 11 | Consistency rules in CI | `npx liarjs` ([liarjs.dev](https://liarjs.dev)) | Any of ~40 open-source cross-layer rules fail - this is the one that runs unattended |Checks 1, 3 and 7 are the ones worth wiring into CI: they are cheap, deterministic, and they catch the defects that actually recur.

The runtime handles login state, proxy credentials, and an API key. Profiles are local by default, but enabling sync places one in the cloud, and license verification has no offline mode.

View source
SKILL.md:101In the instructionsOpen original file
Any tool that drives logged-in sessions receives cookies and proxy credentials, so it is fair to ask what it does with them. For antibrow:| Artifact | Where it lives | Who sees it ||---|---|---|| Cookies, `localStorage`, login state | `~/.anti-detect-browser/profiles/<id>/user-data/` on your disk, or `profiles-temp/<id>/` for a temporary profile | Local. Cloud sync is opt-in per profile: a launch never creates a cloud profile by itself, and `sync: true` is what puts one there. Check which profiles sync before assuming they stay on the machine || Persona (`persona.json`) | same profile directory, written once and frozen | Local || Profile identity record (`profile.json`) | same profile directory; the id it holds is what names the directory | Local. It is why a rename does not cost a persona, and why the folder name is not the profile name || Proxy URL and its credentials | passed to the kernel at launch; answered in the network stack (HTTP 407 / SOCKS5 RFC 1929) so no extension holds them | The kernel process and your proxy provider || API key | your environment, or `~/.antibrow/license.key` | Exchanged with `antibrow.com` for a short-lived license token, roughly once a day |
SKILL.md:121In the instructionsOpen original file
Point it at a proxy whose logs you can read, or at a local MITM proxy, and watch what leaves the machine during a launch. Pin the SDK version and check the published hash (`npm view anti-detect-browser@2.8.0 dist.integrity`) so the code you audited is the code that runs. If a deployment must not phone home at all, this is the wrong tool: license verification is compiled into the kernel and there is no offline mode.
Start here · InstructionsSKILL.md
multi-account-isolation
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Read keys or account settings
SKILL.md:3In the instructionsOpen original file
name: multi-account-isolationdescription: Verify that browser profiles are actually isolated from one another instead of assuming it - confirm each profile's timezone agrees with its own exit IP, that WebRTC exposes only the proxy, that canvas and WebGL hashes stay identical across relaunches of one profile, and that no two profiles share a persona, a cookie jar, or an address. Use when several of your own accounts or test identities run from one machine and the setup needs checking, when a profile tested clean but something still looks off, when choosing which detection suites to run (CreepJS, whoer, browserleaks WebRTC, pixelscan, liarjs), when auditing what a vendor runtime does with API and proxy credentials, or when asking which layers browser isolation cannot cover at all. Also for 'profile isolation check', 'fingerprint consistency test', 'timezone mismatch', 'WebRTC leak', 'canvas hash unstable', 'account association', 'temporary profile', '防关联', '多账号', '隔离自检'. The SDK is anti-detect-browser; MCP is browser-mcp-agent.license: MIT
SKILL.md:33In the instructionsOpen original file
const ab = new AntiDetectBrowser({ key: process.env.ANTI_DETECT_BROWSER_KEY })
SKILL.md:36In the instructionsOpen original file
const identities = [  { profile: 'fixture-us-01', proxy: process.env.PROXY_US_1, tags: ['Windows 10', 'Chrome'] },  { profile: 'fixture-us-02', proxy: process.env.PROXY_US_2, tags: ['Apple Mac', 'Safari'] },
Read files
SKILL.md:9In the instructionsOpen original file
A profile that *looks* isolated usually is not. The failures are boring and mechanical: a timezone that does not match the exit IP, a WebRTC candidate carrying the real address, a canvas hash that changes on every read, two profiles that ended up on the same persona. This skill is the check list for catching those before they matter.
Connect to websites
SKILL.md:76In the instructionsOpen original file
| 1 | Timezone matches the exit IP | `browser.timezone` vs the country of `browser.public_ip` | `geoip` was disabled, or `timezone` was forced to something the IP contradicts. This is the single most common defect. || 2 | WebRTC exposes only the proxy | [browserleaks.com/webrtc](https://browserleaks.com/webrtc) | ICE candidates still carry a local or real public address || 3 | Canvas hash is stable across launches | Read it, close, relaunch the same profile, read again | The two reads differ - a value that changes every read is itself an anomaly, and it means the persona is not frozen |
SKILL.md:78In the instructionsOpen original file
| 3 | Canvas hash is stable across launches | Read it, close, relaunch the same profile, read again | The two reads differ - a value that changes every read is itself an anomaly, and it means the persona is not frozen || 4 | Worker and main thread agree | [CreepJS](https://abrahamjuliot.github.io/creepjs/) | UA, `languages`, `hardwareConcurrency`, timezone or GPU differ when re-read inside a Web Worker || 5 | One GPU across three interfaces | CreepJS, or read WebGL / WebGL2 / WebGPU directly | `adapter.info.vendor` does not match the unmasked WebGL renderer family |
SKILL.md:84In the instructionsOpen original file
| 9 | One identity, one profile tree | Confirm every launch of a name passes the same `temporary` value | A managed `gmail` and a temporary `gmail` are two different profiles with two personas and two cookie jars. A script that disagrees wi …| 10 | Whole-stack coherence | [whoer.net](https://whoer.net), [pixelscan.net](https://pixelscan.net) | IP, timezone and locale disagree at a glance || 11 | Consistency rules in CI | `npx liarjs` ([liarjs.dev](https://liarjs.dev)) | Any of ~40 open-source cross-layer rules fail - this is the one that runs unattended |
Install extra software packages
SKILL.md:85In the instructionsOpen original file
| 10 | Whole-stack coherence | [whoer.net](https://whoer.net), [pixelscan.net](https://pixelscan.net) | IP, timezone and locale disagree at a glance || 11 | Consistency rules in CI | `npx liarjs` ([liarjs.dev](https://liarjs.dev)) | Any of ~40 open-source cross-layer rules fail - this is the one that runs unattended |
Run commands
SKILL.md:113In the instructionsOpen original file
```bashpython -m antibrow info          # kernels, profiles, license state, cache dir
Lines read
146
File checksum (to compare versions)
45c5c8fc6f578fe90b98d52afe1f586673be95f17df5fb3ce9b910fd37cfde44