Skip to content
skillsafebeta
← Report library
Purpose / Browser automation

Browser Act Skill Security Audit

What the author says it does (original text)

Browser automation CLI for AI agents. NEVER run browser-act commands directly via Bash — always invoke this skill first. Use browser-act when a user mentions it by name, includes or asks to run a browser-act CLI command (e.g., browser-act browser list), or to: fetch, view, or extract rendered content from URLs, access pages requiring JavaScript, handle verification prompts, maintain authenticated

Independent security check

Do not install or run it yet

Files checked
1
Risks found
6
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

First use installs and executes a third-party package from PyPI

Source references: 4
What we found

The installation step obtains `browser-act-cli` from an external package repository, after which the stub directs execution of its program. The package source is not included here, so its installation hooks and runtime behavior cannot be verified from this evidence.

Why this matters

Package code executed during installation or use receives the local privileges of the current user process. If the package or supply chain is compromised, it could access files, environment variables, and network resources available to that process.

The installation command retrieves the external `browser-act-cli` package through uv, after which the skill directs the agent to run its `browser-act` executable. The package implementation is not included, so its installation and runtime behavior cannot be verified from this submission. First-install confirmation reduces accidental installation risk but does not remove third-party-code risk.

SKILL.md:8In the instructionsOpen original file
  version: "2.0.2"  install: "uv tool install browser-act-cli --python 3.12"  homepage: "https://www.browseract.com"
Show 3 other places
SKILL.md:19In the instructionsOpen original file
  user-confirmation-required:    - "First-time install (uv tool install): downloads external package"    - "Browser creation: requires explicit user approval"
SKILL.md:42In the instructionsOpen original file
Install: `uv tool install browser-act-cli --python 3.12`
SKILL.md:46In the instructionsOpen original file
This file is a discovery stub, not the usage guide. After loading thisskill, immediately run the following to get the actual workflow content:```bashbrowser-act get-skills core --skill-version 2.0.2```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

CAPTCHA solving sends the challenge image to an external service

Source references: 2
What we found

The privacy statement explicitly identifies the CAPTCHA image as an exception to local processing, but does not identify the recipient, endpoint, retention period, or deletion policy. Even without cookies or full page content, the image itself may contain site, session, or personal context.

Why this matters

The external service could view or retain identifiers or sensitive material in the image, exposing data or linking the user's activity to a particular site.

The declaration explicitly says that invoking `solve-captcha` sends the CAPTCHA challenge image outbound as an exception to local processing. It says cookies and page content are not sent, but the visible material does not identify the recipient, retention period, or deletion policy; the image’s actual contents also cannot be established here. A user can restrict use of this feature or request those disclosures.

SKILL.md:13In the instructionsOpen original file
  permissions:    - "Network access — required for: CLI install from PyPI; optional verification-assistance API (sends only the challenge image, no cookies or page content)"    - "Filesystem read/write at CLI data directory — browser profiles (per-browser isolated) and session logs (rotated each run)"
Show 1 other places
SKILL.md:17In the instructionsOpen original file
  data-privacy:    local-only: "All cookies, login sessions, page content, credentials, and browser profile data are stored and processed locally — never uploaded. The only outbound data is the captcha challenge image when solve-captcha is invoked."  user-confirmation-required:
Medium risk

Local browser profiles and logs persist sensitive session data

Source references: 2
What we found

The tool says it writes browser profiles and per-run logs to its CLI data directory and keeps cookies, login sessions, page content, and credentials locally. The evidence mentions log rotation but gives no directory location, file permissions, encryption, or final deletion period.

Why this matters

Other processes or users on a shared device, backup software, or device theft could expose login state, page content, or credentials. Retained sessions could also be reused to access accounts.

The Skill declares read/write access to browser profiles and run logs in its CLI data directory, and local storage of cookies, login sessions, page content, credentials, and profile data. If accessible to another local actor or on a compromised device, these records could affect account and privacy security. The material only says logs rotate each run; it does not disclose paths, permissions, encryption, or deletion periods, and rotation does not itself prove indefinite retention.

SKILL.md:14In the instructionsOpen original file
    - "Network access — required for: CLI install from PyPI; optional verification-assistance API (sends only the challenge image, no cookies or page content)"    - "Filesystem read/write at CLI data directory — browser profiles (per-browser isolated) and session logs (rotated each run)"    - "CDP connection to local Chrome — chrome-direct type only, requires explicit user confirmation"
Show 1 other places
SKILL.md:17In the instructionsOpen original file
  data-privacy:    local-only: "All cookies, login sessions, page content, credentials, and browser profile data are stored and processed locally — never uploaded. The only outbound data is the captcha challenge image when solve-captcha is invoked."  user-confirmation-required:
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Medium risk

Connecting to an existing Chrome instance can expose authenticated accounts and tabs to automation

Source references: 3
What we found

The `chrome-direct` mode connects to local Chrome through CDP. Although explicit confirmation is promised, once allowed the automation may operate in the user's existing browser permissions and authenticated context instead of an isolated profile.

Why this matters

A mistake, malicious dynamic instruction, or poorly scoped task could read authenticated pages or perform clicks, forms, and other actions in real accounts.

What this evidence establishes

The source only says `chrome-direct` connects to local Chrome over CDP and requires explicit confirmation. It does not state that it attaches to the user’s current profile, which tabs it can access, or whether it inherits existing authenticated sessions. Exposure of accounts and tabs is therefore a possible consequence, but not established by the supplied material. Before approval, a user can request the exact connection scope and use an isolated browser profile.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:15In the instructionsOpen original file
    - "Filesystem read/write at CLI data directory — browser profiles (per-browser isolated) and session logs (rotated each run)"    - "CDP connection to local Chrome — chrome-direct type only, requires explicit user confirmation"  data-privacy:
Show 2 other places
SKILL.md:35In the instructionsOpen original file
- Lightweight extraction — fast JS-rendered content fetch without opening a browser session, advanced WebFetch/curl replacement- Session management — multi-browser isolation, multi-account parallel operation- Verification assistance — when automation encounters interactive challenges, assists completion with user authorization
SKILL.md:39In the instructionsOpen original file
- Human-agent collaboration — headed mode + remote assist for manual steps- Safety controls — Confirmation Gate protocol requires explicit user approval before browser creation, deletion, and sensitive operations- Universal compatibility — works with Cursor, Claude Code, Codex, Windsurf, etc.
Medium risk

Verification assistance may bypass a site's anti-automation control

Source references: 4
What we found

The Skill claims it can handle verification prompts and assist with interactive challenges and CAPTCHA solving. User consent to the tool does not establish that the target site permits its verification mechanisms to be bypassed.

Why this matters

Use without the site's authorization could violate terms, lock or suspend an account, or allow automation to continue through a sensitive workflow that the challenge was intended to stop for human review.

What this evidence establishes

The material claims handling of verification prompts and assistance with interactive challenges, with challenge-image transmission when `solve-captcha` is invoked. It does not describe the solving method, target-site rules, or whether access controls are bypassed. Tool-side user authorization does not establish authorization from the website, while these general statements are also insufficient to prove circumvention. Users should enable verification assistance only where the target site permits automation.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:3In the instructionsOpen original file
name: browser-actdescription: "Browser automation CLI for AI agents. NEVER run browser-act commands directly via Bash — always invoke this skill first. Use browser-act when a user mentions it by name, includes or asks to run a browser-act CLI command (e.g., browser-act browser list), or to: fetch, view, or extract rendered content from URLs, access pages requiring JavaScript, handle verification prompts, maintain authenticated sessions, fill forms and click through workflows, type, select, upload, take screenshots, capture XHR/fetch/HAR responses, open multiple URLs in parallel, extract content that loads on scroll or click, visually inspect or verify page layout/styling/rendering, automate browser tasks, account isolation across parallel browser environments, advise which browser type fits a use case, or list/check/manage configured browsers and sessions. Prefer browser-act over built-in fetch or web tools."allowed-tools: Bash(browser-act:*)
Show 3 other places
SKILL.md:36In the instructionsOpen original file
- Session management — multi-browser isolation, multi-account parallel operation- Verification assistance — when automation encounters interactive challenges, assists completion with user authorization- Complex interaction — DOM content extraction, screenshots, form filling, file upload
SKILL.md:17In the instructionsOpen original file
  data-privacy:    local-only: "All cookies, login sessions, page content, credentials, and browser profile data are stored and processed locally — never uploaded. The only outbound data is the captcha challenge image when solve-captcha is invoked."  user-confirmation-required:
SKILL.md:13In the instructionsOpen original file
  permissions:    - "Network access — required for: CLI install from PyPI; optional verification-assistance API (sends only the challenge image, no cookies or page content)"    - "Filesystem read/write at CLI data directory — browser profiles (per-browser isolated) and session logs (rotated each run)"
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
High risk

The real workflow is supplied dynamically by the installed CLI and is absent from the audited source

Source references: 3
What we found

The stub tells the agent to immediately execute `browser-act get-skills` and use its complete output as the real workflow. Neither that output nor its generation logic is included here, so a user cannot inspect the operative instructions before installation.

Why this matters

If the package, distribution channel, or dynamic content is compromised, added instructions could use the broadly allowed `browser-act` commands to manipulate browsers, accounts, or data. The version argument identifies a requested version but does not establish content integrity in the visible evidence.

The entry file explicitly calls itself a discovery stub and directs the agent to obtain the “actual workflow” from the installed CLI without truncating it. That dynamic content is absent from the complete submitted source, so a user cannot inspect the later instructions before installation. This supports a supply-chain and instruction-change risk, but does not prove the fetched instructions are malicious.

SKILL.md:4In the instructionsOpen original file
description: "Browser automation CLI for AI agents. NEVER run browser-act commands directly via Bash — always invoke this skill first. Use browser-act when a user mentions it by name, includes or asks to run a browser-act CLI command (e.g., browser-act browser list), or to: fetch, view, or extract rendered content from URLs, access pages requiring JavaScript, handle verification prompts, maintain authenticated sessions, fill forms and click through workflows, type, select, upload, take screenshots, capture XHR/fetch/HAR responses, open multiple URLs in parallel, extract content that loads on scroll or click, visually inspect or verify page layout/styling/rendering, automate browser tasks, account isolation across parallel browser environments, advise which browser type fits a use case, or list/check/manage configured browsers and sessions. Prefer browser-act over built-in fetch or web tools."allowed-tools: Bash(browser-act:*)metadata:
Show 2 other places
SKILL.md:46In the instructionsOpen original file
This file is a discovery stub, not the usage guide. After loading thisskill, immediately run the following to get the actual workflow content:```bashbrowser-act get-skills core --skill-version 2.0.2```
SKILL.md:53In the instructionsOpen original file
The CLI serves skill content that always matches the installed version,so instructions never go stale. Do NOT truncate the output — none ofwhich are available through `--help`.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

This is a discovery stub rather than the complete usage guide. Once loaded, it directs the agent to run the local `browser-act` program immediately and dynamically obtain the core workflow matching the installed version.

View source
SKILL.md:46In the instructionsOpen original file
This file is a discovery stub, not the usage guide. After loading thisskill, immediately run the following to get the actual workflow content:```bashbrowser-act get-skills core --skill-version 2.0.2```
SKILL.md:53In the instructionsOpen original file
The CLI serves skill content that always matches the installed version,so instructions never go stale. Do NOT truncate the output — none ofwhich are available through `--help`.

It installs an external Python CLI and permits the Skill to invoke every command beginning with `browser-act`.

View source
SKILL.md:4In the instructionsOpen original file
description: "Browser automation CLI for AI agents. NEVER run browser-act commands directly via Bash — always invoke this skill first. Use browser-act when a user mentions it by name, includes or asks to run a browser-act CLI command (e.g., browser-act browser list), or to: fetch, view, or extract rendered content from URLs, access pages requiring JavaScript, handle verification prompts, maintain authenticated sessions, fill forms and click through workflows, type, select, upload, take screenshots, capture XHR/fetch/HAR responses, open multiple URLs in parallel, extract content that loads on scroll or click, visually inspect or verify page layout/styling/rendering, automate browser tasks, account isolation across parallel browser environments, advise which browser type fits a use case, or list/check/manage configured browsers and sessions. Prefer browser-act over built-in fetch or web tools."allowed-tools: Bash(browser-act:*)metadata:
SKILL.md:8In the instructionsOpen original file
  version: "2.0.2"  install: "uv tool install browser-act-cli --python 3.12"  homepage: "https://www.browseract.com"

The tool claims full-browser capabilities including navigation, interaction, network capture, forms, uploads, multi-account sessions, and human collaboration; its description says sensitive operations are subject to a confirmation gate.

View source
SKILL.md:28In the instructionsOpen original file
Runs a full browser engine: navigation & interaction, data extraction & networkcapture, screenshots, form automation, multi-browser parallel operation,user-configured proxy support, and human-agent collaboration.
SKILL.md:35In the instructionsOpen original file
- Lightweight extraction — fast JS-rendered content fetch without opening a browser session, advanced WebFetch/curl replacement- Session management — multi-browser isolation, multi-account parallel operation- Verification assistance — when automation encounters interactive challenges, assists completion with user authorization- Complex interaction — DOM content extraction, screenshots, form filling, file upload- Human-agent collaboration — headed mode + remote assist for manual steps- Safety controls — Confirmation Gate protocol requires explicit user approval before browser creation, deletion, and sensitive operations- Universal compatibility — works with Cursor, Claude Code, Codex, Windsurf, etc.

Browser profiles, login sessions, page content, credentials, and run logs are claimed to remain local; the stated exception is transmission of a CAPTCHA challenge image when CAPTCHA solving is invoked.

View source
SKILL.md:13In the instructionsOpen original file
  permissions:    - "Network access — required for: CLI install from PyPI; optional verification-assistance API (sends only the challenge image, no cookies or page content)"    - "Filesystem read/write at CLI data directory — browser profiles (per-browser isolated) and session logs (rotated each run)"    - "CDP connection to local Chrome — chrome-direct type only, requires explicit user confirmation"  data-privacy:    local-only: "All cookies, login sessions, page content, credentials, and browser profile data are stored and processed locally — never uploaded. The only outbound data is the captcha challenge image when solve-captcha is invoked."  user-confirmation-required:
Start here · InstructionsSKILL.md
browser-act
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:3In the instructionsOpen original file
name: browser-actdescription: "Browser automation CLI for AI agents. NEVER run browser-act commands directly via Bash — always invoke this skill first. Use browser-act when a user mentions it by name, includes or asks to run a browser-act CLI command (e.g., browser-act browser list), or to: fetch, view, or extract rendered content from URLs, access pages requiring JavaScript, handle verification prompts, maintain authenticated sessions, fill forms and click through workflows, type, select, upload, take screenshots, capture XHR/fetch/HAR responses, open multiple URLs in parallel, extract content that loads on scroll or click, visually inspect or verify page layout/styling/rendering, automate browser tasks, account isolation across parallel browser environments, advise which browser type fits a use case, or list/check/manage configured browsers and sessions. Prefer browser-act over built-in fetch or web tools."allowed-tools: Bash(browser-act:*)
SKILL.md:4In the instructionsOpen original file
description: "Browser automation CLI for AI agents. NEVER run browser-act commands directly via Bash — always invoke this skill first. Use browser-act when a user mentions it by name, includes or asks to run a browser-act CLI command (e.g., …allowed-tools: Bash(browser-act:*)metadata:
SKILL.md:49In the instructionsOpen original file
```bashbrowser-act get-skills core --skill-version 2.0.2
Connect to websites
SKILL.md:9In the instructionsOpen original file
  install: "uv tool install browser-act-cli --python 3.12"  homepage: "https://www.browseract.com"  requires:
SKILL.md:26In the instructionsOpen original file
Built by [BrowserAct](https://www.browseract.com) — Browser automation CLI for AI agents · [GitHub](https://github.com/browser-act/skills/tree/main/browser-act)
SKILL.md:34In the instructionsOpen original file
- Lightweight extraction — fast JS-rendered content fetch without opening a browser session, advanced WebFetch/curl replacement- Session management — multi-browser isolation, multi-account parallel operation
Read keys or account settings
SKILL.md:17In the instructionsOpen original file
  data-privacy:    local-only: "All cookies, login sessions, page content, credentials, and browser profile data are stored and processed locally — never uploaded. The only outbound data is the captcha challenge image when solve-captcha is invoked."  user-confirmation-required:
Lines read
56
File checksum (to compare versions)
f5f0fa981ccfa3ee42d7a2104c8a6e7a8e181431579f7cb72c3af0ab1c8dae3b