skills

Least-privilege permissions

• Create dedicated accounts for each browser automation task—never reuse personal credentials or shared login information. If one task gets compromised, others stay safe.
• Restrict credential access by storing passwords/tokens in a separate secure vault (like a password manager) and only provide the agent access to what it absolutely needs for one specific job.
• Limit API and website permissions the agent can access—don't give it login credentials to 10 sites if it only needs 2. Remove access immediately when tasks end.
• Rotate credentials regularly (every 30–90 days) and revoke old ones, especially after sensitive work like account testing or data collection.

Network isolation

• Run the agent on a separate machine or isolated network rather than on your main business computer or shared infrastructure—this contains damage if the tool is compromised.
• Block outbound access to unnecessary websites and services; only allow connections to the specific domains the agent needs for its assigned work.
• Use a VPN or proxy if the agent accesses external websites, so those sites don't see your real location or network identity.
• Audit where data flows—know exactly which servers the agent talks to and ensure responses aren't leaking to untrusted third parties.

Monitoring

• Log all agent activity: which websites it visits, what data it reads, and how long it runs. Review logs weekly for unusual behavior.
• Set alerts for suspicious patterns—logins from new locations, failed authentication attempts, or access to unexpected accounts or domains.
• Monitor resource usage (CPU, memory, network traffic) for signs the tool is scraping data or performing tasks outside its intended scope.
• Track credential usage: flag if stored passwords are accessed more often than expected or by multiple unrelated tasks.

Red flags to watch for

• The tool accesses websites or accounts beyond what the specific task requires, or uses credentials more broadly than intended.
• Unusual or malicious website content appears during automation (suspicious pop-ups, redirects, injected text)—the agent may be executing instructions hidden in web pages.
• Data or session information leaks across separate browser sessions when they should be completely isolated, or accounts interfere with each other.
• The vendor releases no updates, has no known users, or doesn't respond to security questions—this is a sign the tool hasn't been battle-tested and may harbor hidden vulnerabilities.