Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-09
This skill is a command-line wrapper around the Browserbase cloud-browser service. It lets an agent create, list, inspect and terminate remote browser sessions, keep logins alive between sessions using Browserbase "contexts", navigate to URLs, run arbitrary JavaScript on a page, read cookies, take screenshots and download session recordings and logs. All network traffic goes to Browserbase's own endpoints (api.browserbase.com / connect.browserbase.com); no other destination appears in the code, and there is no obfuscation, no download-and-execute, no persistence hooks and no payment or wallet handling. It reads the Browserbase API key and project ID from environment variables and writes only a small local file mapping friendly context names to IDs (~/.browserbase/contexts.json), plus files the user explicitly names for screenshots and recordings. The genuinely powerful parts are inherent to its purpose: arbitrary JavaScript execution in a possibly logged-in browser, dumping cookies of authenticated sessions to stdout, automatic CAPTCHA solving on by default, and recording every session by default. Anyone installing it should be aware that page content the browser visits is fed back into the agent, which is a prompt-injection surface, and that cookie dumps can reveal session tokens.
Instructions try to steer the agent beyond the declared purpose. The skill feeds untrusted web page content back to the agent: navigate --extract-text returns up to 50,000 characters of arbitrary page text (scripts/browserbase_manager.py:561-573) and execute-js returns arbitrary evaluated results (line 630). Text scraped from a hostile site could contain instructions that an agent then acts on, and the agent already holds the Browserbase API key and can run further execute-js in logged-in sessions. No injected instructions were found inside the package files themselves.
| Declared purpose | Create and manage persistent Browserbase cloud browser sessions with authentication persistence, CAPTCHA solving, session recording, screenshots, browser automation (navigate/execute-js/extract text/cookies) and session cleanup. |
| Observed behavior | A single Python CLI (scripts/browserbase_manager.py) that uses the official browserbase SDK plus Playwright over CDP. It reads BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID from the environment, talks only to api.browserbase.com (and a wss://connect.browserbase.com fallback URL containing the API key as a query parameter), stores a name->context-id map under ~/.browserbase/contexts.json, and writes screenshots/recordings to user-specified paths. Commands include execute-js (runs arbitrary user-supplied JavaScript in the session), get-cookies (returns all cookies as JSON on stdout), navigate with text extraction (up to 50k chars of page text returned), get-recording, get-logs and live-url. Sessions default to solve_captchas=True and record_session/log_session=True. No hidden endpoints, no encoded payloads, no shell execution, no persistence or scheduling, no credential transmission beyond the Browserbase auth header. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | HTTPS calls to api.browserbase.com via the browserbase SDK and urllib (delete-context at scripts/browserbase_manager.py:263), plus a CDP WebSocket to connect.browserbase.com. urllib.request.urlretrieve at line 698 fetches a recording URL returned by the API. |
| credentials | needed | Reads BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID from the environment (lines 106, 112, 262, 522). The key is sent only to Browserbase, but is embedded in a WebSocket query string in the fallback connect URL (lines 187, 523). |
| browser | needed | Drives a remote Chromium via Playwright connect_over_cdp; can navigate, screenshot, extract page text, read all cookies and execute arbitrary JavaScript in an authenticated session. |
| filesystem_write | needed | Creates ~/.browserbase (or $BROWSERBASE_CONFIG_DIR) and writes contexts.json (lines 46, 62); writes screenshots and recordings to paths the caller supplies (lines 577, 601, 694, 702). |
| filesystem_read | needed | Reads the local contexts.json name->ID map (line 54). No other local files are read. |
| install_packages | needed | Documentation instructs the user to run pip/uv install of browserbase and playwright plus 'playwright install chromium' (README.md:42-43, SKILL.md:32-33); the script itself does not install anything. |
| severity | finding |
|---|---|
| medium | Arbitrary JavaScript execution in a possibly authenticated browser The execute-js command runs any JavaScript the caller supplies inside the remote browser session, which may be logged into real accounts via a persisted context. This is required for the declared automation purpose, but combined with agent-driven input it allows reading or acting on any page the session can reach. scripts/browserbase_manager.py:630 result_value = page.evaluate(args.code) |
| medium | Full cookie dump printed to stdout get-cookies returns every cookie of the browser context, including session tokens for authenticated sites, as JSON on stdout. Nothing is redacted, so the values enter the agent's transcript and any logs the host keeps. Needed for the stated feature set, but it is a real credential-exposure path. scripts/browserbase_manager.py:664 "cookies": cookies, |
| low | API key embedded in a WebSocket URL When the SDK does not return a connect URL, the script builds one with the API key as a query parameter (also at line 187). The destination is the legitimate Browserbase host, but keys in URLs are more likely to appear in error messages, proxy logs or exception output than keys in headers. scripts/browserbase_manager.py:523 connect_url = f"wss://connect.browserbase.com?apiKey={api_key}&sessionId={session_id}" |
| medium | Untrusted web page text returned to the agent navigate --extract-text injects up to 50k characters of scraped page content into the agent's context. Content from a hostile page can attempt to steer the agent, which holds the Browserbase credentials and can issue further execute-js commands. Callers should treat extracted text as data, not instructions. scripts/browserbase_manager.py:561 text = page.evaluate(""" |
| low | Session recording and logging enabled by default Every session is video-recorded and logged on Browserbase's servers unless --no-record is passed (line 346-348). If the agent logs into sensitive accounts, credentials typed on screen and page contents are stored with the third-party provider. The skill card acknowledges this; users must opt out explicitly. scripts/browserbase_manager.py:347 browser_settings["record_session"] = True |
| low | Automatic CAPTCHA solving on by default CAPTCHA solving is enabled for every created session (also line 331). This is a documented feature of Browserbase, but bypassing anti-bot challenges may violate the terms of service of target sites and is a policy risk rather than a code defect. scripts/browserbase_manager.py:170 browser_settings={"solve_captchas": True}, |
| low | Downloads a URL supplied by the API response to a local path The recording download follows whatever URL the Browserbase API returns and writes it to the user-specified output path. The destination is not validated, so a compromised or unexpected API response could point at another host; the file is only saved, never executed. scripts/browserbase_manager.py:698 urllib.request.urlretrieve(recording.url, args.output) |
| info | Creates a local config directory The script creates ~/.browserbase (or the path in BROWSERBASE_CONFIG_DIR) and stores a JSON map of friendly names to context IDs. No credentials are written there and this is not a persistence or auto-start mechanism. scripts/browserbase_manager.py:46 os.makedirs(base, exist_ok=True) |
| low | Unpinned dependencies Dependencies use minimum-version ranges rather than pinned versions, so a future upstream release (or a compromised one) would be pulled in automatically at install time. The skill card notes this; installing in an isolated environment with pinned versions is safer. scripts/requirements.txt:1 browserbase>=1.0.0 |
| info | Version mismatch between registry metadata and package _meta.json declares version 1.0.0 while SKILL.md frontmatter declares 2.0.0. Cosmetic, but it makes it harder to know exactly which build is installed. skill-card.md:45 1.0.0 (source: server release metadata; artifact frontmatter reports 2.0.0) <br> |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| api.browserbase.com | not in the service index | references/api-quick-ref.md:5 |
| clawhub.ai | not in the service index | skill-card.md:7 |
| docs.example.com | not in the service index | SKILL.md:227 |
| example.com | not in the service index | SKILL.md:149 |
| myapp.com | not in the service index | SKILL.md:206 |
| www.browserbase.com | not in the service index | SKILL.md:25 |
| Binaries invoked | bash, pip, python, python3, uv |
| Environment variables read | BROWSERBASE_CONFIG_DIR |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 6 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
README.md | 107 | 76e906811a799ba7… |
SKILL.md | 266 | baf4332175568494… |
_meta.json | 6 | d1286293e7a562b9… |
references/api-quick-ref.md | 80 | 7e608d3f0f971fe9… |
scripts/browserbase_manager.py | 911 | bda2517977121d0f… |
scripts/requirements.txt | 2 | 1c4b1667dbc3d0f7… |
skill-card.md | 48 | a879f72046a8bcf2… |
For agents
JSON: https://agenteconomy.report/k/browserbase.audit.json · badge: https://agenteconomy.report/k/browserbase.audited.svg ·
skill rating: /k/browserbase · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).