browser-use

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt shows and instructs using API keys and secrets verbatim in commands and config files (e.g., --api-key bu_xxx, --secret API_KEY=xxx, and echo '{"api_key":"your-key-here"}'), which requires the LLM to emit secret values directly and is therefore insecure.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The set includes a high-risk installer pattern (https://browser-use.com/cli/install.sh piped to bash) and custom domains (browser-use.* and a transient trycloudflare tunnel) that can deliver arbitrary binaries or scripts, while the other links are benign placeholders or official sites (including the GitHub cloudflared binary which is acceptable only if verified); therefore the overall source is suspicious primarily because of the direct remote install script and related custom domains.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The required runtime workflow for this skill uses browser-use open/state/click/type/... to navigate to a user-supplied URL and then ingests the resulting page content (e.g., via state, get html/text, and LLM-driven run/extract) into the agent’s LLM context, which is outsider-authored free text from arbitrary web pages.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's setup instructs users to run a one-line installer that fetches and pipes remote code to the shell (curl -fsSL https://browser-use.com/cli/install.sh | bash), which downloads and executes remote code at runtime and is presented as the recommended install path/dependency.