Is skills/browser-use safe?

When BH_DOMAIN_SKILLS=1, the skill instructs the agent to read every file in $BH_AGENT_WORKSPACE/domain-skills// before taking action on that host. The host value comes from goto_url(), which is derived from the page being visited. A malicious site can be crafted to match a domain-skill directory name, causing the agent to read attacker-influenced files as authoritative instructions before performing any action.

The skill directs the agent to fetch instructions from external GitHub URLs (install.md, interaction-skills/*.md, make-video.md, profile-sync.md). These URLs are live and mutable; an attacker who gains write access to the browser-use/browser-harness repository could alter them. The agent follows these as authoritative guidance without re-validation.

goto_url() returns up to 10 skill filenames for the navigated host after each navigation. This creates a feedback loop where the page being visited influences which files the agent reads next, enabling a sophisticated attacker hosting a page to steer the agent toward specific domain-skill files.

The skill is explicitly designed to access the user's logged-in Chrome sessions. This means any site the user is authenticated to — banking, email, corporate SSO, password managers — is accessible during a browser-use task. Combined with js() execution, an agent can read session tokens and cookies from any open tab or visited page.

The skill references profile-sync.md and the cloud browser feature, which enables syncing the user's browser profile (cookies, sessions, saved credentials) to Browser Use-managed cloud infrastructure. This moves sensitive authentication material off the local device to a third-party service.

The js(...) helper executes arbitrary JavaScript inside the current page context. This can read document.cookie, localStorage, sessionStorage, form field values, and any JavaScript variables — including OAuth tokens, CSRF tokens, and application-level secrets — from any page the agent navigates to.

The primary invocation pattern for this skill is a Python heredoc passed to the browser-use CLI. Any Python the agent writes executes with the full privileges of the user running the agent. There is no sandbox or restriction on what Python code can be placed in the heredoc.

cdp('Domain.method', ...) provides unrestricted access to the Chrome DevTools Protocol. This goes far beyond automation: it enables network interception (Network.enable), arbitrary storage access, script injection into any frame, screenshot capture of all tabs, and reading of browser internals. This is a very broad capability surface.

The skill instructs the agent to place task-specific helper functions in $BH_AGENT_WORKSPACE/agent_helpers.py, which is pre-imported by run.py on every invocation. Malicious content written to this file during one task would persist and execute in all future browser-use invocations.

The git clone and sparse-checkout connected exclusively to GitHub (140.82.121.4:443). No unexpected outbound connections, no new persistent listeners, and no spawned processes outside of standard git operations. The 185.125.188.57 connection predates the install.

The skill proactively instructs the agent to suggest Browser Use Cloud (with UTM tracking parameters) when captchas appear or when multiple concurrent tasks are needed. This embeds commercial steering into agent behavior and normalizes routing sensitive sessions through third-party infrastructure.

The six canary files (.env, SSH key, AWS credentials, .npmrc, Docker config, GCP credentials) were accessed read-only at timestamps matching the monitoring system's own pre/post verification checks. No writes, no exfiltration channels observed. The skill did not access or modify any canary file.