Agent Economy ReportAgent Economy ReportCAUTION version 2.0.1 · audited 2026-09-17
This package is a Markdown skill for the browser-use CLI. It instructs an agent to launch and control a browser, fill forms, take screenshots, extract data, manage cookies, connect to cloud browsers, and open Cloudflare tunnels. It can reuse the user's existing Chrome profile and saved logins, save a cloud API key, and run raw JavaScript, Python, and CDP commands. No hidden payload, obfuscated code, wallet or payment redirection, or OS-level persistence was found; the files are instructional documentation. The main concern is the breadth of access: an agent using this skill could act as the logged-in user, read cookies, and expose local services to the internet.
| Declared purpose | Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, or extract information from web pages. |
| Observed behavior | Markdown instructions to invoke browser-use CLI commands via Bash(browser-use:*): open URLs, inspect state, click/type, screenshot, extract HTML/text, evaluate JavaScript, get/set/clear/import/export cookies, connect to local or cloud browsers, use Chrome profiles, start/stop Cloudflare tunnels, manage profile synchronization and updates, self-register for a cloud API key, and execute raw CDP and Python. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| browser | needed | Core capability: open, inspect, click, type, screenshot, and extract web pages (SKILL.md lines 21-24). |
| network | needed | Opens URLs, connects to cloud browser/API, and creates Cloudflare tunnels (SKILL.md lines 23, 39, 105-109, 128). |
| shell | needed | Allowed-tools limits Bash to browser-use:*; every documented action runs through this CLI (SKILL.md line 4). |
| filesystem_read | needed | Can upload local files into file inputs and import cookies from a JSON file (SKILL.md lines 69, 92). |
| filesystem_write | needed | Can save screenshots to a path, export cookies to a file, and store config at ~/.browser-use/config.json (SKILL.md lines 60, 91, 187). |
| credentials | needed | Can use existing Chrome logins/cookies, read/write cookies, and save a cloud API key (SKILL.md lines 29, 88-92, 106). |
| persistence | needed | Background daemon persists browser across commands; cloud profiles and config are stored (SKILL.md lines 9, 114, 187). |
| install_packages | exceeds purpose | browser-use profile update downloads/updates a profile-use binary (SKILL.md line 139). |
| payments | exceeds purpose | No payment or wallet commands were observed in the package. |
| other | needed | Raw Python statement execution and full CDP access are documented for advanced browser control (references/cdp-python.md lines 7, 11-12). |
| severity | finding |
|---|---|
| info | Shell access is declared The front-matter permits Bash commands only with the browser-use prefix, which is the mechanism for the entire skill. It does not grant unrestricted shell, but all browser-use subcommands are available. SKILL.md:4 allowed-tools: Bash(browser-use:*) |
| info | Persistent browser daemon The browser stays running between commands; this is expected for the skill but means an interrupted task can leave an active browser session. SKILL.md:9 A background daemon keeps the browser open across commands, giving ~50ms latency per call. |
| medium | Can reuse the user's authenticated browser Connecting to the user's existing Chrome or profile allows the agent to operate with saved logins and cookies. This is disclosed but should be reviewed before use on sensitive accounts. SKILL.md:29 To use the user's existing Chrome (preserves logins/cookies): run `browser-use connect` first. |
| medium | Arbitrary JavaScript in page context The skill tells agents to run JavaScript in the browser and return the result. This is useful for extraction but can read or modify page content and act under the page's origin. SKILL.md:75 browser-use eval "js code" # Execute JavaScript, return result |
| medium | Cookie access The CLI can read, set, clear, export, and import cookies (lines 88-92). Cookies can contain session tokens, so this capability should be limited to intended browser tasks. SKILL.md:88 browser-use cookies get [--url <url>] # Get cookies (optionally filtered) |
| medium | Stores a cloud API key The agent can save an API key or use BROWSER_USE_API_KEY. This key could be used for paid cloud browser resources. SKILL.md:106 browser-use cloud login <api-key> # Save API key (or set BROWSER_USE_API_KEY) |
| medium | Cloud browser provisioning The command creates a remote browser profile and prints a live URL. A user should confirm cloud browser usage because it may create remote state and consume API resources. SKILL.md:114 `cloud connect` provisions a cloud browser with a persistent profile (auto-created on first use), connects via CDP, and prints a live URL. |
| medium | Exposes local ports through a tunnel The skill can make a local port reachable from the internet. The examples and risk notes warn this should be used only for intended ports and stopped after use. SKILL.md:128 browser-use tunnel <port> # Start Cloudflare tunnel (idempotent) |
| medium | Downloads/updates a binary This command downloads or updates a profile-use binary. It is an auxiliary profile-management step, not part of basic browser automation, and deserves review. SKILL.md:139 browser-use profile update # Download/update profile-use binary |
| high | Arbitrary Python statement execution The reference shows browser-use python can execute arbitrary Python statements with persistent state. This exceeds simple browser automation and provides broad local code execution under the agent's shell user. references/cdp-python.md:7 `browser-use python "statement"` executes one Python statement per call. Variables persist across calls — set a value in one call, use it in the next. |
| high | Raw CDP bridge available The Python bridge exposes browser._run and the raw BrowserSession (line 12), allowing arbitrary Chrome DevTools Protocol commands. This is powerful but documented as advanced control. references/cdp-python.md:11 - `browser._run(coroutine)` — run any async coroutine synchronously (60s timeout) |
| medium | Raw CDP can read cookies The CDP recipe demonstrates reading cookies through Network.getCookies. This is another route to session cookies beyond the CLI cookie commands. references/cdp-python.md:67 browser-use python "cookies = browser._run(cdp.cdp_client.send.Network.getCookies(params={}, session_id=cdp.session_id))" |
| info | Risk disclosure is present The publisher's own risk note confirms the main access concern and recommends using such features only when the user intends it. skill-card.md:25 Risk: Agent-controlled browser sessions can access sensitive websites, authenticated accounts, cookies, and profile data. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| abc.trycloudflare.com | not in the service index | SKILL.md:168 |
| chromedevtools.github.io | not in the service index | references/cdp-python.md:76 |
| clawhub.ai | not in the service index | skill-card.md:9 |
| example.com | not in the service index | SKILL.md:147 |
| github.com | not in the service index | SKILL.md:17 |
| Binaries invoked | base64, bash, python |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 2 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 219 | a8cdeb87bf175560… |
_meta.json | 6 | 9fce44b3f9b69dd3… |
references/cdp-python.md | 76 | 97dff18b0b2f788a… |
references/multi-session.md | 92 | 6320cac141a19f8f… |
skill-card.md | 61 | 88c3a196fc2e2a67… |
For agents
JSON: https://agenteconomy.report/k/browser-use.audit.json · badge: https://agenteconomy.report/k/browser-use.audited.svg ·
skill rating: /k/browser-use · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).