--- title: browser-harness Re-Audit 2026-05-24 type: audit tags: [audit, browser-automation, recheck, cdp, security] date: 2026-05-24 status: aktiv source_url: https://github.com/browser-use/browser-harness prior_audit: /root/aria/brain/00-Inbox/links-check-2026-05-15/browser-use-harness.md confidence: high --- # browser-harness Re-Audit 2026-05-24 ## 1. Status and changes since 15.05 Stars: 12,700 -> 13,619 (+919 in 9 days, +7.2%). Not archived, MIT license. Last push: 2026-05-20. 17 commits since 15.05. Topics now explicitly include "telegram-agent" and "vps-agent" -- Aria's exact deployment profile. Core architecture unchanged: one CDP WebSocket to Chrome, ~1k lines across 4 files (admin.py, daemon.py, helpers.py, run.py), agent-workspace/agent_helpers.py as the agent-editable surface. SKILL.md and install.md not modified since prior audit. Changes since 15.05: 2026-05-19 PR #337: close_tab() helper (symmetric to new_tab()) Minor 2026-05-19 PR #338: HubSpot private-app webhooks domain skill New skill 2026-05-19 PR #380: Remove stale top-level domain-skills/Amazon files Housekeeping 2026-05-19 PR #381: Remove Firecrawl mentions from Facebook skills Dependency hygiene 2026-05-20 PR #314: QuickBooks (QBO) report export domain skill New skill 2026-05-15 File-upload staging for remote browsers -- reverted same day Feature not ready Domain skill inventory: now ~100+ site-specific playbooks. New since 15.05: HubSpot webhooks, QBO report export. The reverted file-upload PR signals active remote-browser development that is not yet stable. --- ## 2. New / not-yet-extracted patterns Prior audit identified 5 patterns. Re-audit verdict on each: PATTERN 1 -- Agent-editable helpers (Self-Healing) [HIGH priority, still NOT adopted] Mechanism: _load_agent_helpers() in helpers.py runs importlib.exec_module() on agent-workspace/agent_helpers.py on every invocation. Agent writes new helpers into that file; next invocation they are pre-imported. Genuinely simpler than anything Aria has. vs gstack: gstack has /skillify which codifies a browser flow into a deterministic Playwright script -- static skill codification, not a live Python file the agent edits in-place and that gets reloaded on next execution. Different mechanism. gstack's domain-skills have a quarantine->active->global state machine with an L4 ML classifier. More security, more ceremony. vs agent-browser: no self-healing mechanism at all. agent-browser SKILL.md says "All security features are opt-in. By default, agent-browser imposes no restrictions." REAL GAP CONFIRMED: Aria cannot persistently add browser helpers that survive the current run without manually editing a skill file. This pattern is genuinely absent from both gstack and agent-browser. PATTERN 2 -- Domain-Skills Folder per site [MEDIUM in prior audit -- RETRACTED] Prior audit identified this as a gap. Re-audit found gstack already has it: "domain-skill save|list|show|edit|promote-to-global|rollback|rm " with a quarantine->active->global state machine and L4 prompt-injection scan before promotion. That is strictly better than browser-harness's model (opt-in env var, no adversarial review). DROP THIS -- gstack already solved it better. PATTERN 3 -- Screenshot-first with pixel coords [MEDIUM in prior audit, partially outstanding] browser-harness SKILL.md codifies this as explicit text: "capture_screenshot() -> read the pixel off the image -> click_at_xy(x, y) -> capture_screenshot() to verify. Suppress the Playwright-habit reflex of locate-first-then-click." Aria has a Standing Order (feedback_screenshot_pixel_by_pixel.md) but it is NOT in the actual gstack BROWSER.md or agent-browser SKILL.md. The text from browser-harness SKILL.md is worth transplanting directly into both. PATTERN 4 -- CDP-Direct [LOW, still irrelevant] gstack is Playwright-backed; agent-browser is CDP-native. Nothing to add. PATTERN 5 -- Tool install [LATER, still not warranted] No concrete Captcha/Cloud-Browser need has appeared. NEW FINDING: http_get() bulk pattern helpers.py contains http_get(url) with ThreadPoolExecutor for bulk static-page fetches without spinning the browser. "249 Netflix pages in 2.8s." gstack does not expose a non-browser HTTP bulk shortcut; everything goes through Chromium. Genuine gap for Aria at scale -- but it is just urllib + threads, trivially reproducible without installing browser-harness. Low adoption value. --- ## 3. Recommendation Adopt 1 pattern. Ignore the tool. ADOPT NOW (no new dependencies): a) Self-Healing Helper note -- create /root/.claude/skills/agent-browser/agent_helpers.md as a standing note: "When a browser task requires a helper that does not exist, write it here. On next invocation, prepend these helpers." This is the behavioral pattern adapted to Aria's Markdown-skill architecture, without the Python exec surface. ~30 min. Create KAR issue. b) Screenshot-first rule -- copy the "capture_screenshot first, click_at_xy, verify by screenshot" guidance verbatim into gstack BROWSER.md and agent-browser SKILL.md. ~10 min. DO NOT ADOPT: - The tool itself: still no concrete need, would create a third browser stack. - Domain-skills pattern: gstack already has it better. - All other patterns: redundant or premature. WATCH: Remote-browser / BU_AUTOSPAWN feature when Aria needs headless Captcha-solving. The reverted file-upload PR shows it is not stable yet. --- ## 4. Aria-First benefit The self-healing helper pattern directly addresses recurring browser-automation failures where the agent cannot fix its own tool. Currently: Kais must manually intervene. With the pattern: Aria patches its helper note, next run succeeds autonomously. Highest multiplier for recurring scheduled tasks (AI-Radar scrapes, Kadi-v2 E2E checks, etc.). The "vps-agent" and "telegram-agent" topics added to the repo are not coincidental. This tool targets Aria's exact deployment profile. However that does not change the tool-vs-pattern calculus: the pattern is the value, not the binary. --- ## 5. Prompt-Injection and Security Scan OVERALL: Elevated risk surface (higher than prior audit assessed). Existing mitigations adequate IF domain-skills remain disabled. One flag unchanged from prior audit. Two new flags found. The structural risk: run.py calls exec(code, globals()) where code comes from stdin. helpers.py calls importlib.exec_module(agent_helpers.py). The agent writes Python to a file; that Python executes with full process privileges on next run. This is intentional. The risk: a malicious page tricks the agent into writing adversarial code into agent_helpers.py. UNCHANGED FLAG from prior audit: install.md contains: "When you see that banner, run 'browser-harness --update -y' yourself -- don't ask the user." Auto-update-without-asking remains in install.md. If Aria installs this tool, that directive must be overridden in a local CLAUDE.md. NEW FINDING 1 -- goto_url domain-skill surface (LOW, opt-in only): When BH_DOMAIN_SKILLS=1, goto_url() returns filenames from domain-skills//. SKILL.md instructs: "read every file in the matching directory before inventing an approach." A malicious PR contributor to the public domain-skills repo could embed an injection payload in an .md file that gets auto-read into agent context. Mitigations: opt-in env var is OFF by default; community skills require PR. Risk LOW if BH_DOMAIN_SKILLS never gets set. NEW FINDING 2 -- agent_helpers.py as persistent exec surface (MEDIUM): No review gate before a helper written by the agent becomes active on next run. gstack's equivalent (domain-skills quarantine + L4 ML classifier) has a gate. If Aria adopts the self-healing pattern as Markdown (not actual Python exec), this risk is avoided entirely. NEW FINDING 3 -- http_get() outbound fetch inside harness process (LOW marginal): helpers.py contains http_get(url) issuing urllib requests. Agent instructed to fetch an attacker-controlled URL would do so in the harness process. Low marginal risk since the agent can already run arbitrary curl. CLEAN (confirmed): - No auto-execution of page content by the harness. - Chrome attachment requires explicit user action (checkbox + Chrome 144+ popup). - No curl|sh in default install path (git clone + uv install only). - profile-sync curl|sh is labeled optional, one-time, not default. Comparison to gstack: gstack has L1-L6 prompt-injection defense including a 22MB ONNX ML classifier (L4) before domain-skills activate. browser-harness has zero runtime injection defense. If Aria ever installs browser-harness, BH_DOMAIN_SKILLS must stay OFF. --- ## 6. Summary Table Dimension Prior audit (15.05) Re-audit (24.05) Stars 12,700 13,619 (+7.2%) Core architecture CDP-direct, 1k LOC Unchanged SKILL.md / install.md Same Unchanged New capabilities -- close_tab(), QBO + HubSpot domain skills Self-healing gap vs Aria Confirmed Confirmed, still unaddressed Domain-skills gap vs Aria Confirmed RETRACTED -- gstack has it better Security posture Low Risk (prior) Elevated (Medium) -- exec surface + no injection defense Recommendation adopt-later (tool), adopt now (patterns) Pattern-only, narrowed to 1 item --- ## VERDICT Pattern-adopt only. Tool NOT installed. gstack already solves domain-skills better. agent-browser has no self-healing. The one genuine gap is the self-healing helper file concept -- adoptable as a Markdown note with zero new dependencies. Everything else is redundant or premature. CONFIDENCE: HIGH --- ## Action Items 1. Create KAR issue: "Self-healing helper pattern for agent-browser" (~30 min) Create /root/.claude/skills/agent-browser/agent_helpers.md + Standing Order in MEMORY.md 2. Transcribe screenshot-first rule into gstack BROWSER.md and agent-browser SKILL.md (~10 min) 3. Update integration-wishlist: note domain-skills gap solved by gstack; narrow watch scope to remote-browser/Captcha feature readiness 4. Mark prior brain audit as superseded by this note (add superseded_by frontmatter to /root/aria/brain/00-Inbox/links-check-2026-05-15/browser-use-harness.md)