Security Audit

browser-use/browser-harness:root

github.com/browser-use/browser-harness

AI SkillCommit cc9bb24cafeb

CRITICAL

Scanned about 6 hours ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

browser-use/browser-harness:root received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.

SkillShield's automated analysis identified 74 findings: 38 critical, 25 high, 11 medium, and 0 low severity. Key findings include Persistence / self-modification instructions, Network egress to untrusted endpoints, Arbitrary command execution.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 0/100, indicating areas for improvement.

Last analyzed on August 30, 2026 (commit cc9bb24c). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

Static Code Analysis

Dependency Graph

93%

LLM Behavioral Safety

85%

Behavioral Risk Signals

Network Access

22 findings

Filesystem Write

4 findings

Shell Execution

49 findings

Dynamic Code

6 findings

Excessive Permissions

9 findings

Security Findings74

Severity	Finding	Layer	Location
CRITICAL	Persistence / self-modification instructions Shell RC file modification for persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.	Manifest	src/browser_harness/admin.py:329
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	src/browser_harness/daemon.py:232
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	src/browser_harness/daemon.py:272
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	src/browser_harness/daemon.py:297
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	src/browser_harness/run.py:85
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	src/browser_harness/video_render.py:95
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	tests/unit/test_admin.py:537
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	tests/unit/test_admin.py:564
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	tests/unit/test_admin.py:596
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	tests/unit/test_run.py:93
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	tests/unit/test_run.py:162
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	tests/unit/test_run.py:181
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	tests/unit/test_run.py:200
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	tests/unit/test_run.py:218
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:49
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:378
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:750
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:785
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:906
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:909
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:991
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:1011
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:1014
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:1018
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:1023
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:1065
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:1218
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:1226
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:1230
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/daemon.py:176
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/macos.py:85
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/telemetry.py:197
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/video_render.py:108
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/video_render.py:398
CRITICAL	Arbitrary command execution Python dynamic code execution (exec/eval/compile) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/run.py:406
CRITICAL	Arbitrary command execution Remote code download piped to interpreter Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:749
CRITICAL	Arbitrary command execution Remote code download piped to interpreter Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	src/browser_harness/admin.py:774
CRITICAL	Dangerous call: exec() Call to 'exec()' detected in function '_run'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/run.py:406
HIGH	Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions.	Manifest	agent-workspace/domain-skills/browser-use-cloud/cleanup-zombies.py:17
HIGH	Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions.	Manifest	src/browser_harness/recorder.py:17
HIGH	Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions.	Manifest	tests/integration/test_js.py:122
HIGH	Unsafe deserialization / dynamic eval Python variable indirection to hide dangerous calls Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions.	Manifest	src/browser_harness/helpers.py:561
HIGH	Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'sync_local_profile'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:785
HIGH	Dangerous call: subprocess.Popen() Call to 'subprocess.Popen()' detected in function 'ensure_daemon'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:378
HIGH	Dangerous call: subprocess.check_output() Call to 'subprocess.check_output()' detected in function 'list_local_profiles'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:750
HIGH	Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'run_update'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:1218
HIGH	Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'run_update'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:1226
HIGH	Dangerous call: subprocess.check_output() Call to 'subprocess.check_output()' detected in function '_process_start_time'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:49
HIGH	Dangerous call: subprocess.check_output() Call to 'subprocess.check_output()' detected in function '_chrome_running'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:906
HIGH	Dangerous call: subprocess.check_output() Call to 'subprocess.check_output()' detected in function '_chrome_running'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:909
HIGH	Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function '_launch_browser'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:1011
HIGH	Dangerous call: subprocess.Popen() Call to 'subprocess.Popen()' detected in function '_launch_browser'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:1018
HIGH	Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function '_open_chrome_inspect'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:1065
HIGH	Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'run_update'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:1230
HIGH	Dangerous call: subprocess.Popen() Call to 'subprocess.Popen()' detected in function '_launch_browser'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:991
HIGH	Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function '_launch_browser'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:1014
HIGH	Dangerous call: subprocess.Popen() Call to 'subprocess.Popen()' detected in function '_launch_browser'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/admin.py:1023
HIGH	Dangerous call: subprocess.check_output() Call to 'subprocess.check_output()' detected in function 'supported_browser_running'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/daemon.py:176
HIGH	Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'approve_remote_debugging'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/macos.py:85
HIGH	Dangerous call: subprocess.Popen() Call to 'subprocess.Popen()' detected in function '_send_detached'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/telemetry.py:197
HIGH	Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'run_harness'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/video_render.py:108
HIGH	Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function '_run'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	src/browser_harness/video_render.py:398
HIGH	Indirect Prompt Injection via Domain-Specific Skills The skill instructions in `SKILL.md` direct the LLM to automatically read all files in the `$BH_AGENT_WORKSPACE/domain-skills/<site>/` directory when `BH_DOMAIN_SKILLS=1` is enabled and a site-specific task is performed. If the workspace contains untrusted files (e.g., from a cloned repository or user-uploaded content), an attacker can place a malicious markdown file in a domain-skills directory (e.g., `domain-skills/example-site/exploit.md`). When the agent navigates to that site, it will be coerced into reading and executing the instructions in the malicious file, leading to indirect prompt injection. Avoid instructing the LLM to blindly read all files in a workspace directory. Instead, require explicit user confirmation before reading domain-specific skill files, or restrict the search path to a secure, read-only system directory rather than the mutable agent workspace.	LLM	SKILL.md:11
MEDIUM	Potential hardcoded secret (high entropy) A high-entropy string (entropy=4.89) was found in a credential-like context. Verify this is not a hardcoded secret. Use environment variables for sensitive values.	Static	src/browser_harness/telemetry.py:18
MEDIUM	Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	agent-workspace/domain-skills/browser-use-cloud/cleanup-zombies.py:31
MEDIUM	Suspicious import: socket Import of 'socket' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	src/browser_harness/_ipc.py:2
MEDIUM	Suspicious import: socket Import of 'socket' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	src/browser_harness/admin.py:4
MEDIUM	Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	src/browser_harness/admin.py:8
MEDIUM	Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	src/browser_harness/auth.py:23
MEDIUM	Suspicious import: socket Import of 'socket' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	src/browser_harness/daemon.py:2
MEDIUM	Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	src/browser_harness/daemon.py:2
MEDIUM	Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	src/browser_harness/helpers.py:6
MEDIUM	Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	src/browser_harness/run.py:1
MEDIUM	Unpinned Python dependency version Dependency 'mcp>=2.0.0,<3' is not pinned to an exact version. Pin Python dependencies with exact versions where feasible.	Dependencies	pyproject.toml

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/6a72bf5f4e5ac6d8.svg)](https://skillshield.io/report/6a72bf5f4e5ac6d8)