browser-use

The code is a wrapper that ensures uv is installed from an external source and then delegates execution to either a local recipe.py or the browser-use CLI via uv. While the wrapper itself is straightforward, it introduces a supply-chain risk by executing remote installer scripts without integrity verification. If the remote installer is compromised, arbitrary code could execute with user privileges. The immediate risk is medium due to remote installation, but the script’s behavior is primarily orchestration rather than payload. Recommended hardening: verify installer integrity (checksums/signatures), pin a known-good uv version or vendor a bundled installer, and validate installer responses before execution.

SUSPICIOUS: the skill is broadly aligned with browser automation, and its installs/data flows largely match official Browser Use and Astral tooling. However, its scope is high-impact: arbitrary web actions, authenticated profile reuse, cookie handling, cloud API usage, and public tunneling create meaningful security risk and possible sensitive-data exposure even without clear malicious intent.