open-source
Pass
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: SAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: Documentation in
references/quickstart.mddescribes a method for syncing browser profiles via a script from the library's official domain (https://browser-use.com/profile.sh). This is presented as an optional utility for developers using the project. - [COMMAND_EXECUTION]: The reference files contain numerous examples of standard CLI commands for environment setup, package installation, and browser management (e.g.,
uvx browser-use install), which are typical for developer documentation. - [DATA_EXFILTRATION]: The skill documents library features for managing
sensitive_dataand syncing browser storage states (cookies/localStorage) with cloud-based infrastructure (cloud.browser-use.com). These represent standard functionality for the library's ecosystem. - [PROMPT_INJECTION]: As the library is designed to automate web browsers and process live website content (the primary ingestion point), the documentation addresses the risk of indirect prompt injection from untrusted web pages. It provides specific mitigation strategies (boundary markers/sanitization), such as the
allowed_domainsparameter for navigation restriction and thesensitive_datadictionary for masking credentials from the LLM during form interactions.
Audit Metadata