Is fast-browser-use safe?
https://clawhub.ai/rknoche6/fast-browser-use
fast-browser-use is a legitimate Rust-based browser automation tool with a comprehensive CDP integration, but it presents significant security concerns for AI agent use. The skill provides unrestricted arbitrary JavaScript execution, cookie/session theft capabilities, and bot detection bypass — all explicitly documented as features. While no malicious behavior was detected during installation and canary files remained intact, the breadth of capabilities combined with social-engineering recipe titles ('Cookie Heist', 'Bypass Bot Detection') make this skill a high-risk component in multi-skill agent environments.
Category Scores
Findings (9)
HIGH SKILL.md normalizes adversarial browser techniques -30 ▶
The SKILL.md includes recipes titled 'Bypass Bot Detection via Human Emulation' and 'Login & Cookie Heist' that coach the agent to circumvent security controls and steal session credentials. While these may have legitimate automation use cases, presenting them as named recipes normalizes these behaviors and makes the agent more likely to employ them without user scrutiny.
HIGH Arbitrary JavaScript execution enables credential theft -30 ▶
The evaluate tool allows executing arbitrary JavaScript in the browser context of any page the agent navigates to. This can be used to extract authentication tokens, session IDs, form data, and any other page-accessible data. Combined with the navigate tool, extracted data could be sent to attacker-controlled endpoints.
HIGH Excessive capability scope beyond stated purpose -25 ▶
The skill claims to be a 'DOM extraction' and 'browser automation' tool but includes capabilities for arbitrary JS execution, cookie management, local storage access, session persistence/replay, and human emulation for bot detection bypass. This scope far exceeds what's needed for the stated purpose of 'token-efficient DOM extraction'.
MEDIUM Embedded JavaScript injected into browser pages -20 ▶
Multiple JavaScript files are embedded into the skill and injected into browser page contexts during DOM extraction and content conversion. While the reviewed code (extract_dom.js, convert_to_markdown.js) appears to perform legitimate DOM analysis and Readability extraction, the pattern of injecting JS into arbitrary page contexts creates an attack surface if these files were modified.
MEDIUM Brew tap installation could execute arbitrary code -25 ▶
The skill specifies installation via a Homebrew tap (rknoche6/tap/fast-browser-use). Homebrew tap formulae are Ruby scripts that can execute arbitrary code during installation, including downloading and running external binaries. This install vector was not exercised during this audit (ClawHub install was used instead).
MEDIUM Cookie and local storage tools enable session hijacking -20 ▶
Dedicated tools for reading/writing cookies and local storage allow an agent to extract all session data from any origin it visits, persist it to files, and replay it later. This is explicitly demonstrated in the 'Cookie Heist' recipe.
LOW CODEBUDDY.md included alongside SKILL.md -5 ▶
A CODEBUDDY.md file is included that provides detailed architectural guidance for the codebase. While this is a development aid, some agent frameworks may also parse and follow instructions in non-SKILL.md files, potentially expanding the skill's influence on agent behavior.
INFO Framework bootstrapping reads sensitive files during install -10 ▶
Filesystem monitoring showed reads of .env, .aws/credentials, .bashrc, .profile, and OpenClaw configuration files. These are attributable to the OpenClaw agent framework bootstrapping process, not the skill itself. However, this demonstrates that sensitive files are accessible in the execution environment.
INFO High-risk skill combination potential -15 ▶
While this skill alone cannot directly read local filesystem credentials, when combined with skills that have filesystem access, an attacker could chain: (1) filesystem skill reads sensitive files, (2) this skill navigates to attacker-controlled URL with data as parameters, or (3) this skill's evaluate tool posts data to an external endpoint via fetch(). The skill is a powerful exfiltration vehicle in a multi-skill environment.