browser-use-cloud

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to auto-register, receive an api_key, and then embed that key verbatim into connection strings, headers, environment variables and CLI commands (e.g., WSS ?apiKey=..., -H "x-browser-use-api-key: ..."), forcing the LLM to handle and output secret values directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The code contains no hidden exec/evasion or direct exfiltration/backdoor payloads, but it intentionally implements anti-detection, account automation, proxy rotation, disposable email/2FA automation, and persistent session reuse — features clearly designed to evade safeguards and facilitate account abuse/scraping.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The auto-registration script calls https://api.browser-use.com/cloud/signup (and /cloud/signup/verify) at runtime to retrieve an obfuscated math "challenge" that is meant to be solved by an LLM/user—the fetched challenge text thus directly drives the prompt/answer flow and is a required runtime dependency for obtaining an API key.