Skills/npm/lean-browser-use

lean-browser-use@0.1.4

VERIFIED· install only

Publisher claims: "Cut browser use cost by about 25% in Claude Code: fresh runner subagent, bulk reads, three guards and a token meter. One npx command" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher aunysillyme · publishing for 20 daysInstalls 1,028Last detonated 1 h ago
$claude mcp add lean-browser-use -- npx -y lean-browser-use
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
File permission modification commandsearxng/test_searx_offline.py:67 · File permission modification command — agent changes file ownership/permissionsself.assertIn('chmod 700', deploy)Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedsearxng/test_searx.py:48 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packageagents/aun-browser-runner.md:51 · npx invocation of non-well-known package — may execute untrusted code…lling the task done: close remaining job tabs, stop its tasks and servers, run `npx lean-browser-use doctor`, verify the evidence, then remove the handoff scratch. Return a report…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/doctor.mjs:65 · npx invocation of non-well-known package — may execute untrusted code…ssions.size} session(s): ${[...surfaces].sort().join(', ')}. Close them, or run npx lean-browser-use keep --reason "<why>" --session ID` : 'No stale open browser surfaces recorded.…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandsearxng/deploy.sh:8 · File permission modification command — agent changes file ownership/permissionschmod 700 "$(dirname "$SECRET_FILE")"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedreader/test_reader_2.py:164 · Python subprocess execution detectedresult = subprocess.run([reader.crawl4ai_python(), "-c", script, "fetch"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagepackage.json:4 · npx invocation of non-well-known package — may execute untrusted code"description": "Cut browser use cost by about 25% in Claude Code: fresh runner subagent, bulk reads, three guards and a token meter. One npx command",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandsearxng/test_searx_offline.py:66 · File permission modification command — agent changes file ownership/permissionsself.assertIn('chmod 600', deploy)Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packageagents/aun-browser-runner.md:47 · npx invocation of non-well-known package — may execute untrusted code5. Run `npx --yes lean-browser-use cleanup --apply` as the last command. Copy its `cleanup:` line into the report, alongside the tab and process checks and any pending IDs.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageagents/aun-browser-runner.md:43 · npx invocation of non-well-known package — may execute untrusted code… Closing the run's tabs ends the control. Hold a tab the user must act on with `npx --yes lean-browser-use keep --reason "<why>"` and name it in the report. Otherwise th…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedreader/test_reader_2.py:321 · Python subprocess execution detectedrun = subprocess.run([sys.executable, str(ROOT / "reader"), "run", "npm-package"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathsreader/test_reader_3.py:169 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files@checks.mark.parametrize("url", ["file:///etc/passwd", "http://127.0.0.1"])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedreader/reader_compile.py:49 · Python subprocess execution detectedreturn subprocess.run(command_args, input=prompt, text=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedreader/test_reader_2.py:315 · Python subprocess execution detectedcompiled = subprocess.run([sys.executable, str(ROOT / "reader"), "compile", "bad", "--url", url,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathsreader/test_reader_2.py:312 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files@checks.mark.parametrize("url", ["file:///etc/passwd", "http://127.0.0.1"])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagehooks/stop-gate.mjs:27 · npx invocation of non-well-known package — may execute untrusted code…trol. Tabs the user already had open stay open. To hold a tab for the user, run npx lean-browser-use keep --reason "<why>". Then say what stays open and why in the reply.`; conso…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageagents/aun-browser-runner.md:18 · npx invocation of non-well-known package — may execute untrusted code…annot expand it. Start every browser or helper process this run needs through `npx --yes lean-browser-use spawn -- <command> [args]`, so each one carries a lease that c…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandsearxng/deploy.sh:13 · File permission modification command — agent changes file ownership/permissionschmod 600 "$SECRET_FILE"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedreader/reader_crawl.py:46 · Python subprocess execution detectedresult = subprocess.run(command, input=json.dumps(payload), capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathsreader/test_reader.py:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files@checks.mark.parametrize("url", ["file:///etc/passwd", "ftp://example.com", "data:text/html,hello",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/doctor.mjs:74 · npx invocation of non-well-known package — may execute untrusted code…ror' : 'ok', live.length ? `Leftover leased processes: ${list.join('; ')}. Run: npx lean-browser-use cleanup --apply` : 'No leased processes are running.'); } catch { add('leftov…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈635 tok
1 file · 80 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for lean-browser-use@0.1.4 as of 47 min ago. This is the package itself, not its dependencies.