browser-use

No clear evidence of intentional malware (e.g., hardcoded secrets, persistence/backdoors, or exfiltration to fixed external endpoints) is present in this module. However, the stdio transport can execute an arbitrary user-supplied command via subprocess.Popen(..., shell=True), which is a high-impact security risk if --stdio is attacker-influenced. The HTTP transport similarly allows connections to arbitrary user-supplied URLs and forwards custom headers, which can increase SSRF/credential-header manipulation risk in broader automation contexts. Overall, this component is best treated as security-sensitive and should be used only with fully trusted inputs and strong argument controls.