Xiaopi Agent Browser

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:39 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is mostly coherent, but it documents reusable login-session storage and sensitive browser capture features without enough safety guidance.

Review this carefully before installing. Use it only for sites and accounts you intend to automate, avoid saving authenticated state unless necessary, treat state files and recordings as secrets, clean them up after use, and prefer a pinned or isolated install instead of a global latest-version install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16
• Finding: Unpinned Third-Party Package and Source Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 16-26; `CONTRIBUTING.md`, lines 15-18 **Vulnerability Type**: Unpinned and unverifiable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md`, lines 16-18: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` `SKILL.md`, lines 23-26: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build ``` `CONTRIBUTING.md`, lines 15-18: ```bash 1. Install the latest version ```bash npm install -g agent-browser@latest ``` ``` ### Technical Analysis The installation instructions retrieve and execute third-party package content without pinning an audited package version, Git commit, or integrity digest. The explicit use of `@latest` further directs users to install whichever release is current at execution time. NPM installation and source builds can execute lifecycle or build scripts supplied by the downloaded package and its transitive dependencies. A global installation may also place executable files into shared user-level or system-level binary locations, depending on the NPM configuration and privileges used. The Git-based installation similarly follows the repository's default branch and resolves dependencies through `pnpm install` without identifying a reviewed commit or documented lockfile verification procedure. Consequently, the effective code installed by users can change after this skill package has been audited. This finding does not establish that the current upstream package is malicious. The vulnerability is the absence of reproducible version pinning and integrity controls, which creates a supply-chain attack opportunity. ### Attack Path 1. An attacker compromises the upstream NPM package, its maintainer account, the source repository, or a transitive dependency. 2. The attacker publishes a malicious release, modifies the default branch, or introduces ...[truncated 1112 chars]
• Remediation: ## Remediation Suggestions 1. Pin `agent-browser` to a specifically reviewed version rather than using an implicit current release or `@latest`: ```bash npm install --global agent-browser@<reviewed-version> ``` 2. Publish and verify the expected NPM integrity digest or signed provenance for the approved package artifact. 3. For source installation, pin the repository to a full reviewed commit hash: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout <reviewed-full-commit-hash> ``` 4. Require a committed lockfile and use a frozen or immutable installation mode so dependency resolution cannot silently change: ```bash pnpm install --frozen-lockfile ``` 5. Avoid global installation where possible. Prefer a project-local installation or an isolated container with restricted filesystem and network permissions. 6. Explicitly warn users not to run installation commands with `sudo` or administrative privileges. 7. Add an update process that reviews new versions, dependency changes, lifecycle scripts, and build scripts before changing the pinned version. 8. Ensure `SKILL.md` and `CONTRIBUTING.md` reference the same reviewed version and integrity verification procedure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documented screenshot, PDF, video recording, upload, and state-saving features can write local files or capture sensitive on-screen/account data, yet the skill gives no caution about filesystem modification or secret capture. In an autonomous agent workflow, this increases the risk of collecting or persisting credentials, personal data, internal pages, or proprietary content without user awareness.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly documents setting HTTP basic-auth credentials and saving/loading browser session state, but provides no warning that these values may contain passwords, cookies, or bearer-equivalent session material. In an agent context, this can lead to persistent storage, reuse, or accidental disclosure of secrets that grant account access without re-authentication.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 93% confidence
• Finding: The skill exposes session persistence through saving and loading browser state, which commonly includes authentication cookies and other session tokens. Without guardrails or warnings, an agent may persist reusable authenticated state to disk, enabling account takeover or lateral access if the file is exposed or reused inappropriately.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 95% confidence
• Finding: The authentication example normalizes saving login state to 'auth.json' and reloading it later, effectively encouraging storage of reusable authenticated sessions. In the context of an agent skill, examples strongly influence behavior, so this increases the likelihood of unsafe token persistence and replay across runs.

Static analysis

No suspicious patterns detected.