Agent Economy ReportAgent Economy ReportCAUTION version 1.0.1 · audited 2026-09-17
This package provides documentation and setup files for a browser automation tool. It tells an agent to run npm install and npm link, then use a command called 'browser' to visit websites, click and type, extract page data, take screenshots, and close the browser. It needs an Anthropic API key and may use a remote Browserbase browser automatically if those credentials are present; otherwise it launches local Chrome with a persistent profile. The documented risks include retained saved passwords and cookies, access to localhost or internal networks, and downloads saved without file type restrictions. I found no hidden network destinations, obfuscated code, or download-and-execute behavior, so the package is not clearly malicious, but it requires powerful access and user review.
| Declared purpose | Automate web browser interactions using natural language via CLI commands for browsing websites, navigating pages, extracting data, taking screenshots, filling forms, clicking buttons, and interacting with web applications. |
| Observed behavior | The package is primarily documentation and setup metadata. It instructs an agent to run npm install and npm link on first setup, check setup.json, and then use a global 'browser' CLI with navigate, act, extract, observe, screenshot, and close commands. It documents automatic selection between local Chrome and remote Browserbase based on .env keys, use of an Anthropic API key, Chrome DevTools Protocol on port 9222, a persistent .chrome-profile, and saving screenshots and downloads under ./agent/ directories. It includes examples for filling forms, logging in, downloading a file, searching Google, and debugging pages; the actual executable source is referenced as src/cli.ts but is not included in these files. |
| Verdict, rules only | CAUTION · reads credential-like environment variables: ANTHROPIC_API_KEY |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | SKILL.md line 4 allows Bash; setup and normal use invoke npm and the 'browser' CLI as shell commands. |
| network | needed | The skill navigates to websites, and REFERENCE.md states full network access including localhost and internal networks. |
| filesystem_read | needed | SKILL.md line 20 reads setup.json; setup.json line 17 reads .env for ANTHROPIC_API_KEY and optional Browserbase credentials. |
| filesystem_write | needed | The tool writes screenshots to ./agent/browser_screenshots/ and downloads to ./agent/downloads/; setup also asks the agent to edit setup.json. |
| credentials | needed | Requires ANTHROPIC_API_KEY for the AI model and can use saved browser passwords and cookies from the persistent profile. |
| persistence | exceeds purpose | Uses a persistent Chrome profile .chrome-profile where sessions, saved passwords, and cookies persist between runs. |
| install_packages | needed | First-time setup runs npm install and npm link, installing dependencies and creating a global 'browser' command. |
| browser | needed | Core purpose is controlling Chrome/Stagehand to navigate, act, extract, observe, and screenshot pages. |
| severity | finding |
|---|---|
| medium | Skill requests Bash access The skill frontmatter explicitly permits Bash, which is used for npm setup and every browser CLI command. A user should review this because it allows shell commands on the host. SKILL.md:4 allowed-tools: Bash |
| medium | Installs npm dependencies On first setup, the skill instructs the agent to run npm install, which fetches and installs third-party Node.js packages. This can introduce supply-chain risk if the package tree is malicious. SKILL.md:23 npm install # Install dependencies |
| medium | Creates a global command Running npm link registers a global 'browser' command, modifying the agent's shell environment so later skill commands can execute the installed package. SKILL.md:24 npm link # Create global 'browser' command |
| medium | Automatic remote browser mode If Browserbase API keys exist in .env, commands will use a remote Browserbase browser automatically. This can send page content and actions to a remote service without asking the user at runtime. SKILL.md:16 - **No user prompting**: The selection happens automatically based on available configuration |
| medium | Requires sensitive Anthropic API key The AI-driven browser actions require an Anthropic API key, either exported or stored in .env. Misuse or leakage could spend money or expose the key. setup.json:17 "description": "ANTHROPIC_API_KEY exported (i.e $ANTHROPIC_API_KEY) or in .env file" |
| medium | Chrome remote debugging on port 9222 Local Chrome is launched with a remote debugging port. Other processes or users with localhost access could attach to this port and control the browser, which may contain logged-in sessions. REFERENCE.md:373 - `--remote-debugging-port`: Enables CDP on port 9222 |
| high | Persistent browser profile retains passwords and cookies The browser profile saves passwords and cookies between sessions. An agent using this skill could access previously authenticated accounts, and those credentials are stored on disk. REFERENCE.md:459 - Saved passwords and cookies persist between sessions |
| medium | Browser can reach internal network endpoints The browser has full network access and can reach localhost and internal networks. A malicious or compromised page could try to probe internal services from the host running the agent. REFERENCE.md:472 - Can access localhost and internal networks |
| medium | Downloads are saved without file type restrictions Downloaded files are automatically saved to ./agent/downloads/. Executable or dangerous file types are not blocked, so the agent may write risky files to disk, though execution is not documented here. REFERENCE.md:465 - No file type restrictions enforced |
| low | Example enters a password through a natural-language command The examples show placing a password directly in a browser act command. Password text may appear in command history, logs, or AI provider processing. EXAMPLES.md:116 browser act "Fill in the password field with 'mypassword'" |
| info | Instructs agent to edit its own setup marker The setup workflow asks the agent to modify setup.json. This is a filesystem write, but it is not unusual for first-run setup. setup.json:32 "6. Update this setup.json file: set all 'installed'/'configured' to true and 'setupComplete' to true" |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| example.com | not in the service index | EXAMPLES.md:13 |
| techcrunch.com | not in the service index | EXAMPLES.md:81 |
| www.google.com | not in the service index | EXAMPLES.md:156 |
| Binaries invoked | bash, curl, npm |
| Environment variables read | ANTHROPIC_API_KEY |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 8 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
EXAMPLES.md | 308 | 3eabcc39097f44d2… |
REFERENCE.md | 535 | 69baf7c1f01a549b… |
SKILL.md | 73 | 9705b3b7bb8d0260… |
_meta.json | 6 | 5290a1bc4644cb84… |
setup.json | 35 | 757323736cdce64d… |
skill-card.md | 58 | 7ce71c6594f399e6… |
For agents
JSON: https://agenteconomy.report/k/browser-automation.audit.json · badge: https://agenteconomy.report/k/browser-automation.audited.svg ·
skill rating: /k/browser-automation · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).