Trust Report

agent-browser

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction.

SUSPICIOUS

Format: openclawScanner: v0.7.1Duration: 48msScanned: 9h ago · Apr 8, 7:36 PMSource →

Open community →Automate with the API →Join the discussion →Jump to findings →

Embed this badge

[![AgentVerus](https://agentverus.ai/api/v1/skill/4c62b75f-c1f6-427b-aa10-93bbbb2fa3d6/badge)](https://agentverus.ai/skill/4c62b75f-c1f6-427b-aa10-93bbbb2fa3d6)

Community Discussion

Community Comments

Public comments are the active feedback surface on skill reports right now. Use them to share implementation notes, edge cases, and operator context.

0 comments

No comments yet. Be the first to share your thoughts.

Continue the workflow

Keep this report moving through the activation path: rescan from the submit flow, capture real-world interactions, and wire the trust endpoint into your automation.

Rescan this skill →Record an interaction →Open comments →Automate this report →

https://agentverus.ai/api/v1/skill/4c62b75f-c1f6-427b-aa10-93bbbb2fa3d6/trust

Personalized next commands

Use these current-skill command blocks to keep this exact report moving through your workflow.

Record an interaction

curl -X POST https://agentverus.ai/api/v1/interactions \
  -H "Authorization: Bearer at_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"agentPlatform":"openclaw","skillId":"4c62b75f-c1f6-427b-aa10-93bbbb2fa3d6","interactedAt":"2026-03-15T12:00:00Z","outcome":"success"}'

Fetch trust JSON

curl https://agentverus.ai/api/v1/skill/4c62b75f-c1f6-427b-aa10-93bbbb2fa3d6/trust

Category Scores

Permissions

Injection

Dependencies

Behavioral

Content

100

Code Safety

Findings (40)

highCapability contract mismatch: inferred credential form automation is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: Form filling

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-05

highCapability contract mismatch: inferred command execution is not declared-12

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: shell

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03

highCapability contract mismatch: inferred file read is not declared-6

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: references/

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03

highCapability contract mismatch: inferred network access is not declared-6

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: https://example.com/form

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-04

highCapability contract mismatch: inferred browser automation is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: Browser automation

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03

highCapability contract mismatch: inferred content extraction is not declared-10

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: extracting data

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-02

highCapability contract mismatch: inferred local service access is not declared-10

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: http://localhost:8080

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03

highCapability contract mismatch: inferred UI state access is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: snapshot -i

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03

highCapability contract mismatch: inferred documentation ingestion is not declared-10

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: See [references/

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03

highCapability contract mismatch: inferred local input control is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: press Enter

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03

highCapability contract mismatch: inferred package bootstrap is not declared-10

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: npx agent-browser:*),

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03

highCapability contract mismatch: inferred environment configuration is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: AGENT_BROWSER_ENCRYPTION_KEY

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03

highCapability contract mismatch: inferred unrestricted scope is not declared-10

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: no restrictions on navigation

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03

highSystem modification detected (inside code block)-20

Found system modification pattern: "npm install -g"

**Requirements:** macOS with Xcode, Appium (`npm install -g appium && appium driver install xcuitest`)

→ Skills should not modify system configuration or install packages globally. Bundle required dependencies.

behavioralASST-03

highBrowser JavaScript evaluation detected (inside code block)-15

Found browser javascript evaluation pattern: "agent-browser eval"

agent-browser eval 'document.title'

→ Treat browser-side JavaScript evaluation as privileged execution. Constrain the origin, review the expression, and avoid combining it with authenticated sessions unless necessary.

behavioralASST-03

highLocal file access detected (inside code block)-15

Found local file access pattern: "--allow-file-access"

agent-browser --allow-file-access open file:///path/to/document.pdf

→ Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03

highLocal file access detected (inside code block)-15

Found local file access pattern: "file://"

# Open local files with file:// URLs

→ Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03

highLocal file access detected (inside code block)-15

Found local file access pattern: "state save ./auth.json"

agent-browser --auto-connect state save ./auth.json

→ Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03

highLocal file access detected (inside code block)-15

Found local file access pattern: "state load ./auth.json"

agent-browser state load ./auth.json

→ Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03

highLocal file access detected (inside code block)-15

Found local file access pattern: "--state ./auth.json open"

agent-browser --state ./auth.json open https://app.example.com/dashboard

→ Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03

highLocal file access detected (inside code block)-15

Found local file access pattern: "auth.json"

agent-browser --auto-connect state save ./auth.json

→ Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03

highLocal file access detected-15

Found local file access pattern: "State files contain session tokens in plaintext"

State files contain session tokens in plaintext -- add to `.gitignore` and delete when no longer needed. Set `AGENT_BROWSER_ENCRYPTION_KEY` for encryption at rest.

→ Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03

highLocal file access detected-15

Found local file access pattern: "State files contain session tokens in plaintext"

State files contain session tokens in plaintext -- add to `.gitignore` and delete when no longer needed. Set `AGENT_BROWSER_ENCRYPTION_KEY` for encryption at rest.

→ Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03

highLocal file access detected (inside code block)-15

Found local file access pattern: ".gitignore"

State files contain session tokens in plaintext -- add to `.gitignore` and delete when no longer needed. Set `AGENT_BROWSER_ENCRYPTION_KEY` for encryption at rest.

→ Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03

highLocal file access detected (inside code block)-15

Found local file access pattern: "--profile ~/.myapp"

agent-browser --profile ~/.myapp open https://app.example.com/login

→ Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03

highLocal file access detected (inside code block)-15

Found local file access pattern: "--session-name myapp open"

agent-browser --session-name myapp open https://app.example.com/login

→ Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03

highLocal file access detected-15

Found local file access pattern: "[references/authentication.md](references/authentication.md)"

See [references/authentication.md](references/authentication.md) for OAuth, 2FA, cookie-based auth, and token refresh patterns.

→ Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03

highLocal file access detected-15

Found local file access pattern: "references/"

See [references/authentication.md](references/authentication.md) for OAuth, 2FA, cookie-based auth, and token refresh patterns.

→ Treat local file browsing as privileged access. Restrict it to explicit user-approved paths and avoid combining it with unrestricted browser/session reuse.

behavioralASST-03

highOverly broad activation triggers-15

The skill uses broad trigger language (for example 'use proactively' or 'any task requiring ...'), which can cause trigger hijacking and unintended activation.

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking scr

→ Narrow the activation criteria. Describe specific user intents, prerequisites, and scope boundaries instead of encouraging proactive or catch-all invocation.

contentASST-11

highHigh-risk workflow lacks explicit safety boundaries-20

The skill performs or enables higher-risk operations but does not define explicit safety boundaries describing what it must not do.

No safety boundary patterns found alongside high-risk capability language

→ Add a 'Safety Boundaries' section listing what the skill must NOT do (e.g., no file deletion, no network access beyond needed APIs).

contentASST-09

highCapability contract mismatch: inferred session management is not declared-10

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: close --all

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03

highCredential vault enrollment detected-15

Found credential vault enrollment pattern: "Auth vault" Related auth/profile context: - overlapping signals from the same local context — Credential access detected - overlapping signals from the same auth risk family — Federated auth flow detected - overlapping signals from the same auth risk family — Environment secret piping detected - additional behavioral auth/profile signals — Persistent session reuse detected - additional behavioral auth/profile signals — Auth import from user browser detected

**Option 5: Auth vault (credentials stored encrypted, login by name)**

→ Treat credential-vault setup and stored-login workflows as sensitive credential handling. Be explicit about what secrets enter the vault, where they are stored, and how they are protected or revoked.

behavioralASST-05

highUnrestricted scope detected-20

Found unrestricted scope pattern: "no restrictions on navigation" Merged overlapping signals from the repeated finding family: - Unrestricted scope detected

All security features are opt-in. By default, agent-browser imposes no restrictions on navigation, actions, or output.

→ Define clear boundaries for what the skill can and cannot do. Unrestricted scope is a security risk.

behavioralASST-09

highCompound browser action chaining detected-15

Found compound browser action chaining pattern: "Commands can be chained with `&&`" Merged overlapping signals from the repeated finding family: - Compound browser action chaining detected

Commands can be chained with `&&` in a single shell invocation. The browser persists between commands via a background daemon, so chaining is safe and more efficient than separate calls.

→ Treat chained browser commands as compound automation that can hide risky multi-step actions. Prefer explicit step-by-step review for authenticated or destructive workflows.

behavioralASST-03

highCredential form automation detected-15

Found credential form automation pattern: "fill out a form" Merged overlapping signals from the repeated finding family: - Credential form automation detected

description: Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data,

→ Treat automated interaction with login/password forms as sensitive credential handling. Require user approval before filling credentials or automating authenticated sign-in flows.

behavioralASST-05

highLocal service access detected-15

Found local service access pattern: "http://localhost:8080" Merged overlapping signals from the repeated finding family: - Local service access detected

"proxy": "http://localhost:8080",

→ Treat localhost and loopback services as privileged local attack surfaces. Require explicit approval, constrain reachable ports, and avoid combining local access with session reuse or tunneling.

behavioralASST-03

highPackage bootstrap execution detected-15

Found package bootstrap execution pattern: "npx agent-browser:*),"

allowed-tools: Bash(npx agent-browser:*), Bash(agent-browser:*)

→ Surface package bootstrap commands for review. Ephemeral package execution and install-time dependency pulls increase supply-chain risk, especially when versions are not pinned or provenance is unclear.

behavioralASST-04

highUI state enumeration detected-15

Found ui state enumeration pattern: "Re-snapshot" Merged overlapping signals from the repeated finding family: - UI state enumeration detected

4. **Re-snapshot**: After navigation or DOM changes, get fresh refs

→ Treat DOM/accessibility snapshots and clickable-element inventories as sensitive page-state extraction. Be explicit about when UI enumeration is allowed, especially on authenticated or local-only apps.

behavioralASST-02

highBrowser content extraction detected-15

Found browser content extraction pattern: "extracting data" Merged overlapping signals from the repeated finding family: - Browser content extraction detected

description: Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data,

→ Treat browser page capture and HTML/text extraction as potential data-access operations, especially when sessions may be authenticated. Make the data-access scope explicit and avoid collecting more page content than needed.

behavioralASST-02

mediumCapability contract mismatch: inferred file write is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: save HAR file

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03