Is @browserbasehq/stagehand safe?

The code turns strings into live code at runtime (eval / new Function / exec).

new Function("");

Why it matters: If those strings aren't fixed and trusted, they become a way to run arbitrary code.

Fix: Avoid evaluating dynamically constructed code; if unavoidable, ensure the input is a trusted constant and never derived from external data.

The component can run operating-system commands or spawn processes.

import { spawn } from "node:child_process";

spawnChrome: (executablePath, args, options) => spawn(executablePath, args, {

const taskkill = spawn("taskkill", [

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

The component makes outbound network requests.

const response = await fetch(currentUrl, {

return await fetch(currentUrl, {

if (typeof init?.body !== "string") return await fetch(input, init);

return await fetch(input, init);

if (!body || typeof body !== "object" || Array.isArray(body)) return await fetch(input, init);

return await fetch(input, {

const locatorRuntimeResponse = await fetch(chrome.runtime.getURL("content-script.js"));

import { validateHeaderName, validateHeaderValue } from "node:http";

const response = await fetch(request, { signal });

async fetch(params) {

async fetch(input) {

return await createBrowserbaseServices(apiKey, baseUrl).fetch(params);

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

An MCP tool surface (manifest or tool definitions) was found.

{

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.