跳转到正文
skillsafebeta
← 报告库
用途分类 / 浏览器操作

Multi Account Isolation Skill 安全审计

作者说它能做什么（原文）

Verify that browser profiles are actually isolated from one another instead of assuming it - confirm each profile's timezone agrees with its own exit IP, that WebRTC exposes only the proxy, that canvas and WebGL hashes stay identical across relaunches of one profile, and that no two profiles share a persona, a cookie jar, or an address. Use when several of your own accounts or test identities run

第三方安全检查结论

先别安装或运行

已检查文件
1
发现的风险
6
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。发现 1 项风险
中风险

未固定版本的 npx 命令可执行随后发布的包代码

原文依据：1 处
发现了什么

清单建议在 CI 中运行 `npx liarjs`，但没有固定包版本或完整性值。npx 在本地缺少该包时通常会获取并执行注册表当前解析到的版本，因此未来的包更新、账号劫持或依赖污染会改变实际执行的代码。

为什么需要注意

受影响的包代码会以 CI 或开发者进程的权限运行，可能读取工作区、环境变量和 CI 凭据，或修改构建产物。

`npx liarjs` 是无人值守 CI 中的主动执行指令，却没有版本号或完整性校验。若环境中未预装该包，npx 通常会从注册表取得并执行当前解析版本；包更新或供应链受损时，执行内容可能改变并接触 CI 可访问的文件或凭据。用户可要求固定版本、锁定依赖，并限制该步骤的网络与凭据权限。

SKILL.md:85来自说明文档打开原文件
| 10 | Whole-stack coherence | [whoer.net](https://whoer.net), [pixelscan.net](https://pixelscan.net) | IP, timezone and locale disagree at a glance || 11 | Consistency rules in CI | `npx liarjs` ([liarjs.dev](https://liarjs.dev)) | Any of ~40 open-source cross-layer rules fail - this is the one that runs unattended |Checks 1, 3 and 7 are the ones worth wiring into CI: they are cheap, deterministic, and they catch the defects that actually recur.
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 3 项风险
高风险

闭源运行时处理登录会话和代理凭据，并强制连接许可证服务

原文依据：4 处
发现了什么

文档明确表示驱动已登录会话的工具会接收 Cookie 和代理凭据；代理凭据交给闭源内核，API 密钥约每天与 antibrow.com 交换一次。内核没有离线模式，因此网络隔离并非受支持的运行方式。所提供材料不足以独立验证内核如何处理或保留这些秘密。

为什么需要注意

若运行时、许可证服务、更新链或主机被攻破，登录 Cookie、代理凭据或 API 密钥可能被滥用，进而危及账号和付费代理资源。

文档说明闭源内核处理代理 URL 和凭据，API 密钥会发送至 antibrow.com 换取许可证令牌，而且没有离线模式。运行登录会话时，本地配置目录还保存 Cookie 和登录状态。因此使用该运行时会把高价值秘密交给无法由所给源码独立检查的组件，并产生强制外连。用户可使用专用低权限凭据、监控出站流量，并向供应商索要保留、加密和审计说明。

SKILL.md:101来自说明文档打开原文件
Any tool that drives logged-in sessions receives cookies and proxy credentials, so it is fair to ask what it does with them. For antibrow:| Artifact | Where it lives | Who sees it ||---|---|---|| Cookies, `localStorage`, login state | `~/.anti-detect-browser/profiles/<id>/user-data/` on your disk, or `profiles-temp/<id>/` for a temporary profile | Local. Cloud sync is opt-in per profile: a launch never creates a cloud profile by itself, and `sync: true` is what puts one there. Check which profiles sync before assuming they stay on the machine || Persona (`persona.json`) | same profile directory, written once and frozen | Local || Profile identity record (`profile.json`) | same profile directory; the id it holds is what names the directory | Local. It is why a rename does not cost a persona, and why the folder name is not the profile name || Proxy URL and its credentials | passed to the kernel at launch; answered in the network stack (HTTP 407 / SOCKS5 RFC 1929) so no extension holds them | The kernel process and your proxy provider || API key | your environment, or `~/.antibrow/license.key` | Exchanged with `antibrow.com` for a short-lived license token, roughly once a day |
查看另外 3 个位置
SKILL.md:111来自说明文档打开原文件
The kernel is a closed-source Chromium build - that is the tradeoff for the spoofing living in C++ rather than in an injectable script - so verify behaviour rather than take it on faith:
SKILL.md:121来自说明文档打开原文件
Point it at a proxy whose logs you can read, or at a local MITM proxy, and watch what leaves the machine during a launch. Pin the SDK version and check the published hash (`npm view anti-detect-browser@2.8.0 dist.integrity`) so the code you audited is the code that runs. If a deployment must not phone home at all, this is the wrong tool: license verification is compiled into the kernel and there is no offline mode.
SKILL.md:105来自说明文档打开原文件
|---|---|---|| Cookies, `localStorage`, login state | `~/.anti-detect-browser/profiles/<id>/user-data/` on your disk, or `profiles-temp/<id>/` for a temporary profile | Local. Cloud sync is opt-in per profile: a launch never creates a cloud profile by itself, and `sync: true` is what puts one there. Check which profiles sync before assuming they stay on the machine || Persona (`persona.json`) | same profile directory, written once and frozen | Local || Profile identity record (`profile.json`) | same profile directory; the id it holds is what names the directory | Local. It is why a rename does not cost a persona, and why the folder name is not the profile name || Proxy URL and its credentials | passed to the kernel at launch; answered in the network stack (HTTP 407 / SOCKS5 RFC 1929) so no extension holds them | The kernel process and your proxy provider || API key | your environment, or `~/.antibrow/license.key` | Exchanged with `antibrow.com` for a short-lived license token, roughly once a day |
高风险

启用云同步会把可复用的登录状态移出本机

原文依据：1 处
发现了什么

配置表说明 Cookie、localStorage 和登录状态位于配置文件目录，但 `sync: true` 会将配置文件放到云端。此类状态可能包含可复用的会话令牌，而材料没有说明云端加密、访问控制、保留或删除机制。

为什么需要注意

云账号、供应商系统或同步权限遭入侵时，攻击者可能取得会话状态并接管关联账号；误启同步也会违反原本的本地保存或数据驻留预期。

材料明确说配置目录包含 Cookie、localStorage 和登录状态，并且启用 `sync: true` 会将配置文件放到云端。登录状态可能包含可复用会话数据，因此该选项会扩大泄露或未授权访问的影响面。材料没有给出云端保护细节；用户可保持同步关闭，或在启用前向供应商确认加密、访问控制、保留、删除及账号恢复策略。

SKILL.md:105来自说明文档打开原文件
|---|---|---|| Cookies, `localStorage`, login state | `~/.anti-detect-browser/profiles/<id>/user-data/` on your disk, or `profiles-temp/<id>/` for a temporary profile | Local. Cloud sync is opt-in per profile: a launch never creates a cloud profile by itself, and `sync: true` is what puts one there. Check which profiles sync before assuming they stay on the machine || Persona (`persona.json`) | same profile directory, written once and frozen | Local |
中风险

外部检测网站会接收到配置文件的 IP 和可识别指纹信号

原文依据：2 处
发现了什么

Skill 指示用户访问 browserleaks、CreepJS、whoer 和 pixelscan 来检查 WebRTC、Canvas、GPU、IP、时区与语言环境。执行这些测试必然向相应网站建立连接，并提供测试所需的网络地址和浏览器指纹表面。

为什么需要注意

这些服务能够观察测试时间、出口 IP 和较稳定的浏览器特征；若使用真实账号配置文件，这些记录可能形成额外的可关联数据。

流程主动要求配置文件通过多个第三方检测站点。连接时这些站点至少会看到出口 IP，并会运行读取 WebRTC、线程属性、GPU、时区和语言环境等指纹面的测试；这可能让第三方记录并关联测试配置。用户可只使用获准站点、隔离测试身份，或要求作者提供可本地运行的替代检查。

SKILL.md:76来自说明文档打开原文件
| 1 | Timezone matches the exit IP | `browser.timezone` vs the country of `browser.public_ip` | `geoip` was disabled, or `timezone` was forced to something the IP contradicts. This is the single most common defect. || 2 | WebRTC exposes only the proxy | [browserleaks.com/webrtc](https://browserleaks.com/webrtc) | ICE candidates still carry a local or real public address || 3 | Canvas hash is stable across launches | Read it, close, relaunch the same profile, read again | The two reads differ - a value that changes every read is itself an anomaly, and it means the persona is not frozen || 4 | Worker and main thread agree | [CreepJS](https://abrahamjuliot.github.io/creepjs/) | UA, `languages`, `hardwareConcurrency`, timezone or GPU differ when re-read inside a Web Worker || 5 | One GPU across three interfaces | CreepJS, or read WebGL / WebGL2 / WebGPU directly | `adapter.info.vendor` does not match the unmasked WebGL renderer family || 6 | No two profiles share a persona | Diff `browser.persona` across the fleet | Two profiles report the same UA, screen geometry and seeds || 7 | No two profiles share an address | Collect `browser.public_ip` for the fleet | Two identities came out of the same exit, or the same /24 || 8 | Cookie jars are separate | Compare `browser.profile_dir` across the fleet, then inspect `user-data/` inside each | Two identities resolve to one directory, or one directory holds state belonging to another identity || 9 | One identity, one profile tree | Confirm every launch of a name passes the same `temporary` value | A managed `gmail` and a temporary `gmail` are two different profiles with two personas and two cookie jars. A script that disagrees with itself about `temporary` is running two identities under one name and will look like a logged-out session, not like a bug || 10 | Whole-stack coherence | [whoer.net](https://whoer.net), [pixelscan.net](https://pixelscan.net) | IP, timezone and locale disagree at a glance || 11 | Consistency rules in CI | `npx liarjs` ([liarjs.dev](https://liarjs.dev)) | Any of ~40 open-source cross-layer rules fail - this is the one that runs unattended |
查看另外 1 个位置
SKILL.md:84来自说明文档打开原文件
| 9 | One identity, one profile tree | Confirm every launch of a name passes the same `temporary` value | A managed `gmail` and a temporary `gmail` are two different profiles with two personas and two cookie jars. A script that disagrees with itself about `temporary` is running two identities under one name and will look like a logged-out session, not like a bug || 10 | Whole-stack coherence | [whoer.net](https://whoer.net), [pixelscan.net](https://pixelscan.net) | IP, timezone and locale disagree at a glance || 11 | Consistency rules in CI | `npx liarjs` ([liarjs.dev](https://liarjs.dev)) | Any of ~40 open-source cross-layer rules fail - this is the one that runs unattended |
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。发现 2 项风险
高风险

该流程可强化多账号之间的不可关联性

原文依据：3 处
发现了什么

它不仅检查普通隐私隔离，还明确要求不同身份使用不同人物指纹、代理、地址和 Cookie 目录，并验证这些差异能否通过检测套件。这些步骤可降低平台通过浏览器和网络信号关联账号的能力。文档中的“仅限授权使用”限制了声明用途，但不能阻止操作者把相同步骤用于规避平台的反欺诈或执法措施。

为什么需要注意

若用于未经平台允许的账号运营，可能帮助隐藏共同控制关系，导致账号封禁、资金冻结、客户损失或合规与法律风险。

这是明确的跨身份反关联流程：要求每个身份独占配置文件、人物指纹、代理和时区，并检查不同配置不得共享人物或地址。即使文档限定为自有或获授权账号，这些操作仍可能降低平台利用浏览器及网络信号关联账号的能力。用户应确认平台条款及账号授权，并要求作者说明如何防止该流程被用于绕过平台执法。

SKILL.md:19来自说明文档打开原文件
One identity gets one of everything. Any cell shared between two identities is a defect to find:```identity  →  profile  →  persona  →  proxy  →  timezone   1      :     1     :     1     :    1    :     1```Profiles are unlimited and free on every antibrow plan, so there is never a reason to reuse one. "Log out and log back in as the other identity" inside one profile defeats the entire setup - the cookie jar and `localStorage` are the point.
查看另外 2 个位置
SKILL.md:80来自说明文档打开原文件
| 5 | One GPU across three interfaces | CreepJS, or read WebGL / WebGL2 / WebGPU directly | `adapter.info.vendor` does not match the unmasked WebGL renderer family || 6 | No two profiles share a persona | Diff `browser.persona` across the fleet | Two profiles report the same UA, screen geometry and seeds || 7 | No two profiles share an address | Collect `browser.public_ip` for the fleet | Two identities came out of the same exit, or the same /24 || 8 | Cookie jars are separate | Compare `browser.profile_dir` across the fleet, then inspect `user-data/` inside each | Two identities resolve to one directory, or one directory holds state belonging to another identity || 9 | One identity, one profile tree | Confirm every launch of a name passes the same `temporary` value | A managed `gmail` and a temporary `gmail` are two different profiles with two personas and two cookie jars. A script that disagrees with itself about `temporary` is running two identities under one name and will look like a logged-out session, not like a bug |
SKILL.md:136来自说明文档打开原文件
**Intended:** verifying isolation between identities you own; running client accounts with the account holder's authorization; building QA fixtures that emulate distinct devices; testing your own anti-fraud and correlation logic; auditing what a browser runtime does with your credentials.**Out of scope, and not supported:** accessing any system without authorization; logging into accounts that are not yours; credential stuffing or account takeover; creating fake accounts, reviews or engagement; circumventing an authentication, payment or authorization control; scraping personal data in violation of applicable law; working around a platform's enforcement decision.Complying with the terms of the platforms being used, and with applicable law, is the operator's responsibility. Report abuse or a security issue via the contact at `https://antibrow.com`.
低风险

安装命令没有固定依赖版本

原文依据：1 处
发现了什么

安装命令没有指定依赖版本。同样的命令以后可能下载不同代码，你实际安装的内容可能与这次检查时不同。

为什么需要注意

即使命令和报告没变，以后安装时也可能下载到另一份代码。

这里是 CI 检查命令，不是常规安装说明，但 `npx liarjs` 未固定版本或完整性值；在本地没有该包时，npx 可能下载并执行当时解析到的代码。未来版本变化会使实际运行内容偏离本次审计。用户可要求固定包版本和锁文件，并在受限 CI 环境中运行。

SKILL.md:85来自说明文档打开原文件
| 10 | Whole-stack coherence | [whoer.net](https://whoer.net), [pixelscan.net](https://pixelscan.net) | IP, timezone and locale disagree at a glance || 11 | Consistency rules in CI | `npx liarjs` ([liarjs.dev](https://liarjs.dev)) | Any of ~40 open-source cross-layer rules fail - this is the one that runs unattended |
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

8 个说明模块

该 Skill 是一份反检测浏览器隔离检查清单，要求每个身份分别使用配置文件、人物指纹、代理和时区，并禁止在同一配置文件中切换身份。

查看原文
SKILL.md:19来自说明文档打开原文件
One identity gets one of everything. Any cell shared between two identities is a defect to find:```identity  →  profile  →  persona  →  proxy  →  timezone   1      :     1     :     1     :    1    :     1```Profiles are unlimited and free on every antibrow plan, so there is never a reason to reuse one. "Log out and log back in as the other identity" inside one profile defeats the entire setup - the cookie jar and `localStorage` are the point.

检查会比较出口 IP、WebRTC、Canvas、GPU、人物指纹、地址和 Cookie 目录，并建议把部分检查接入 CI。

查看原文
SKILL.md:75来自说明文档打开原文件
|---|---|---|---|| 1 | Timezone matches the exit IP | `browser.timezone` vs the country of `browser.public_ip` | `geoip` was disabled, or `timezone` was forced to something the IP contradicts. This is the single most common defect. || 2 | WebRTC exposes only the proxy | [browserleaks.com/webrtc](https://browserleaks.com/webrtc) | ICE candidates still carry a local or real public address || 3 | Canvas hash is stable across launches | Read it, close, relaunch the same profile, read again | The two reads differ - a value that changes every read is itself an anomaly, and it means the persona is not frozen || 4 | Worker and main thread agree | [CreepJS](https://abrahamjuliot.github.io/creepjs/) | UA, `languages`, `hardwareConcurrency`, timezone or GPU differ when re-read inside a Web Worker || 5 | One GPU across three interfaces | CreepJS, or read WebGL / WebGL2 / WebGPU directly | `adapter.info.vendor` does not match the unmasked WebGL renderer family || 6 | No two profiles share a persona | Diff `browser.persona` across the fleet | Two profiles report the same UA, screen geometry and seeds || 7 | No two profiles share an address | Collect `browser.public_ip` for the fleet | Two identities came out of the same exit, or the same /24 || 8 | Cookie jars are separate | Compare `browser.profile_dir` across the fleet, then inspect `user-data/` inside each | Two identities resolve to one directory, or one directory holds state belonging to another identity || 9 | One identity, one profile tree | Confirm every launch of a name passes the same `temporary` value | A managed `gmail` and a temporary `gmail` are two different profiles with two personas and two cookie jars. A script that disagrees with itself about `temporary` is running two identities under one name and will look like a logged-out session, not like a bug || 10 | Whole-stack coherence | [whoer.net](https://whoer.net), [pixelscan.net](https://pixelscan.net) | IP, timezone and locale disagree at a glance || 11 | Consistency rules in CI | `npx liarjs` ([liarjs.dev](https://liarjs.dev)) | Any of ~40 open-source cross-layer rules fail - this is the one that runs unattended |Checks 1, 3 and 7 are the ones worth wiring into CI: they are cheap, deterministic, and they catch the defects that actually recur.

运行时会处理登录状态、代理凭据和 API 密钥；配置文件默认保存在本机，但启用同步会把配置文件放入云端，且许可证验证没有离线模式。

查看原文
SKILL.md:101来自说明文档打开原文件
Any tool that drives logged-in sessions receives cookies and proxy credentials, so it is fair to ask what it does with them. For antibrow:| Artifact | Where it lives | Who sees it ||---|---|---|| Cookies, `localStorage`, login state | `~/.anti-detect-browser/profiles/<id>/user-data/` on your disk, or `profiles-temp/<id>/` for a temporary profile | Local. Cloud sync is opt-in per profile: a launch never creates a cloud profile by itself, and `sync: true` is what puts one there. Check which profiles sync before assuming they stay on the machine || Persona (`persona.json`) | same profile directory, written once and frozen | Local || Profile identity record (`profile.json`) | same profile directory; the id it holds is what names the directory | Local. It is why a rename does not cost a persona, and why the folder name is not the profile name || Proxy URL and its credentials | passed to the kernel at launch; answered in the network stack (HTTP 407 / SOCKS5 RFC 1929) so no extension holds them | The kernel process and your proxy provider || API key | your environment, or `~/.antibrow/license.key` | Exchanged with `antibrow.com` for a short-lived license token, roughly once a day |
SKILL.md:121来自说明文档打开原文件
Point it at a proxy whose logs you can read, or at a local MITM proxy, and watch what leaves the machine during a launch. Pin the SDK version and check the published hash (`npm view anti-detect-browser@2.8.0 dist.integrity`) so the code you audited is the code that runs. If a deployment must not phone home at all, this is the wrong tool: license verification is compiled into the kernel and there is no offline mode.
从这里开始 · 工作说明SKILL.md
multi-account-isolation
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。
文件与检查记录1 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明

代码和说明中提到的操作

读取密钥或账号配置
SKILL.md:3来自说明文档打开原文件
name: multi-account-isolationdescription: Verify that browser profiles are actually isolated from one another instead of assuming it - confirm each profile's timezone agrees with its own exit IP, that WebRTC exposes only the proxy, that canvas and WebGL hashes stay identical across relaunches of one profile, and that no two profiles share a persona, a cookie jar, or an address. Use when several of your own accounts or test identities run from one machine and the setup needs checking, when a profile tested clean but something still looks off, when choosing which detection suites to run (CreepJS, whoer, browserleaks WebRTC, pixelscan, liarjs), when auditing what a vendor runtime does with API and proxy credentials, or when asking which layers browser isolation cannot cover at all. Also for 'profile isolation check', 'fingerprint consistency test', 'timezone mismatch', 'WebRTC leak', 'canvas hash unstable', 'account association', 'temporary profile', '防关联', '多账号', '隔离自检'. The SDK is anti-detect-browser; MCP is browser-mcp-agent.license: MIT
SKILL.md:33来自说明文档打开原文件
const ab = new AntiDetectBrowser({ key: process.env.ANTI_DETECT_BROWSER_KEY })
SKILL.md:36来自说明文档打开原文件
const identities = [  { profile: 'fixture-us-01', proxy: process.env.PROXY_US_1, tags: ['Windows 10', 'Chrome'] },  { profile: 'fixture-us-02', proxy: process.env.PROXY_US_2, tags: ['Apple Mac', 'Safari'] },
读取文件
SKILL.md:9来自说明文档打开原文件
A profile that *looks* isolated usually is not. The failures are boring and mechanical: a timezone that does not match the exit IP, a WebRTC candidate carrying the real address, a canvas hash that changes on every read, two profiles that ended up on the same persona. This skill is the check list for catching those before they matter.
连接外部网站
SKILL.md:76来自说明文档打开原文件
| 1 | Timezone matches the exit IP | `browser.timezone` vs the country of `browser.public_ip` | `geoip` was disabled, or `timezone` was forced to something the IP contradicts. This is the single most common defect. || 2 | WebRTC exposes only the proxy | [browserleaks.com/webrtc](https://browserleaks.com/webrtc) | ICE candidates still carry a local or real public address || 3 | Canvas hash is stable across launches | Read it, close, relaunch the same profile, read again | The two reads differ - a value that changes every read is itself an anomaly, and it means the persona is not frozen |
SKILL.md:78来自说明文档打开原文件
| 3 | Canvas hash is stable across launches | Read it, close, relaunch the same profile, read again | The two reads differ - a value that changes every read is itself an anomaly, and it means the persona is not frozen || 4 | Worker and main thread agree | [CreepJS](https://abrahamjuliot.github.io/creepjs/) | UA, `languages`, `hardwareConcurrency`, timezone or GPU differ when re-read inside a Web Worker || 5 | One GPU across three interfaces | CreepJS, or read WebGL / WebGL2 / WebGPU directly | `adapter.info.vendor` does not match the unmasked WebGL renderer family |
SKILL.md:84来自说明文档打开原文件
| 9 | One identity, one profile tree | Confirm every launch of a name passes the same `temporary` value | A managed `gmail` and a temporary `gmail` are two different profiles with two personas and two cookie jars. A script that disagrees wi …| 10 | Whole-stack coherence | [whoer.net](https://whoer.net), [pixelscan.net](https://pixelscan.net) | IP, timezone and locale disagree at a glance || 11 | Consistency rules in CI | `npx liarjs` ([liarjs.dev](https://liarjs.dev)) | Any of ~40 open-source cross-layer rules fail - this is the one that runs unattended |
安装其他软件包
SKILL.md:85来自说明文档打开原文件
| 10 | Whole-stack coherence | [whoer.net](https://whoer.net), [pixelscan.net](https://pixelscan.net) | IP, timezone and locale disagree at a glance || 11 | Consistency rules in CI | `npx liarjs` ([liarjs.dev](https://liarjs.dev)) | Any of ~40 open-source cross-layer rules fail - this is the one that runs unattended |
运行命令
SKILL.md:113来自说明文档打开原文件
```bashpython -m antibrow info          # kernels, profiles, license state, cache dir
读取了多少行
146
文件校验值（用于核对版本）
45c5c8fc6f578fe90b98d52afe1f586673be95f17df5fb3ce9b910fd37cfde44