Agent-Browser-Bridge-AI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:44 AM UTC
• Version: 3.3.5

Overview

This skill openly focuses on stealth browser automation for bypassing anti-bot controls and scraping data, with additional install and browser-sandbox risks users should review carefully.

Install only if you intentionally need this level of stealth browser automation and can confine it to authorized, lawful targets. Use an isolated environment, pin and verify the npm package, avoid global install where possible, do not use authenticated personal browser profiles, keep Chrome sandboxing enabled, and avoid bulk contact collection or protected-site scraping without explicit permission.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:215

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 215–216

Vulnerability Type: Supply-chain exposure through mutable npm dependencies

Risk Level: High

Code Snippet:

bash

# 1. Install from npm
npm install -g browser-agentbridge-ai
npm run build

Technical Analysis

The installation command retrieves browser-agentbridge-ai from the npm registry without specifying an exact version or verifying an integrity hash. Consequently, the installed code may change after this skill has been reviewed. Global npm installation can also execute package lifecycle scripts with the installing user's privileges.

The artifact contains only SKILL.md; it does not include the package implementation, a lockfile, checksums, or other material that would permit verification of the downloaded code. Claims in the documentation that functionality was source-verified therefore cannot be independently validated from the audited project.

The later use of npx agentbridge start on line 264 creates an additional package-name ambiguity because the documented npm package is browser-agentbridge-ai, while the npx target is agentbridge. If the expected executable is not already resolvable, npx may offer to retrieve and execute registry content associated with the separate name.

Attack Path

1. An attacker compromises a maintainer account or publishes a malicious update under the mutable package version range.
2. Alternatively, package-name ambiguity causes the user to resolve an unintended agentbridge package through npx.
3. A user follows the Quick Start and executes npm install -g browser-agentbridge-ai.
4. npm downloads the current registry release and may execute its lifecycle scripts.
5. The malicious installation script or binary executes with the user's permissions.
6. Because the installed browser bridge is subsequently used for browser sessions, a compromised dependency may also access ...[truncated 644 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a reviewed exact version rather than relying on the latest registry release.
• Supply and verify a lockfile and npm integrity metadata.
• Publish cryptographic checksums or signatures for reviewed release artifacts and verify them before execution.
• Avoid global installation; install into a dedicated, unprivileged project or isolated container.
• Disable or review npm lifecycle scripts where operationally possible, such as by initially installing with --ignore-scripts.
• Document and verify the relationship between the browser-agentbridge-ai package and the agentbridge executable.
• Replace npx agentbridge start with an invocation guaranteed to use the pinned local dependency, such as npx --no-install agentbridge start or an equivalent package-manager command.
• Review the package source and transitive dependency tree before recommending execution.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:254

Finding

Chrome Sandbox Disabled During Arbitrary Web Navigation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 254

Vulnerability Type: Unsafe browser security configuration

Risk Level: High

Code Snippet:

bash

# Launch Chrome headless with remote debugging
google-chrome --headless=new --no-sandbox --remote-debugging-port=9222 &

Technical Analysis

The documented CDP fallback starts Chrome with --no-sandbox, explicitly disabling a principal browser containment boundary. AgentBridge is designed to navigate arbitrary and potentially attacker-controlled websites. Browser content is therefore untrusted, and removing renderer sandboxing increases the consequences of a browser vulnerability.

This option does not itself create a browser exploit, but it weakens defense in depth: a renderer compromise that would ordinarily remain constrained may gain substantially broader access to the browser process and host resources available to the launching user.

The same command enables a remote-debugging endpoint. The subsequent script queries it through 127.0.0.1, but the launch command does not explicitly provide a loopback-only remote debugging address. CDP provides powerful browser-control capabilities, so its network exposure should be minimized and independently verified.

Attack Path

1. A user launches Chrome using the documented command, disabling its sandbox.
2. AgentBridge navigates to an attacker-controlled or compromised website.
3. The website delivers content that exploits a vulnerability in the browser renderer or another reachable browser component.
4. Because sandboxing is disabled, the resulting code has fewer containment boundaries.
5. The attacker may act with the privileges of the Chrome process and access host resources available to the launching user.
6. Separately, if the CDP endpoint is exposed to an untrusted local process or network interface, an attacker able to reach it may control tabs, inspect page content, exec ...[truncated 612 chars]

Remediation

View remediation

Remediation Suggestions

• Remove --no-sandbox and run Chrome with its standard sandbox enabled.
• Correct host or container configuration rather than disabling browser isolation.
• If sandboxing is impossible, run the browser as a dedicated unprivileged user inside a hardened container or virtual machine with minimal filesystem and network access.
• Apply read-only filesystems, dropped Linux capabilities, seccomp/AppArmor/SELinux controls, resource limits, and restricted volume mounts where applicable.
• Explicitly bind remote debugging to loopback, verify that port 9222 is not externally reachable, and block it with host and container firewall rules.
• Do not expose CDP through public interfaces or unauthenticated proxies.
• Use a temporary browser profile without unrelated authenticated sessions or sensitive cookies.
• Keep Chrome patched and terminate the debugging instance immediately after the automation task.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Ssd 2

Critical

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

This section gives concrete, semantically complete anti-detection details: spoofing navigator.webdriver, faking window.chrome, patching plugins/languages/platform/hardwareConcurrency`, and using human-behavior simulation to avoid anti-bot systems. In context, this is effectively operational guidance for bypassing platform defenses and enabling stealthy scraping or account abuse on protected services.

Content

No source excerpt is available for this finding.

Ssd 2

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill introduction explicitly markets 'anti-detection browser control,' 'human-like interactions,' and stealth anti-fingerprinting as core value propositions. This is a strong indicator that the skill is designed to help agents avoid bot detection rather than perform ordinary browser automation, making abusive use substantially more likely.

Content

No source excerpt is available for this finding.

Ssd 2

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The comparison and use cases celebrate 'full access' on previously blocked services and explicitly frame bypassing login walls, anti-bot measures, and protected sites as a feature. That normalization materially increases risk by encouraging deployment for stealth recon, scraping, and access against targets that are actively trying to prevent automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented scrape-emails pipeline automates bulk collection of contact data and CSV export without any warning about consent, privacy obligations, or lawful use. In context, this lowers friction for mass harvesting of personal data and makes misuse easier at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The anti-detection section advertises stealth spoofing, anti-fingerprinting, cookie auto-accept, and anti-bot checks as product features without any safety framing. In this skill's context, those capabilities are not incidental; they are central to bypassing site integrity controls and materially increase the likelihood of abusive automation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Hard-coding browser languages to ['en-US', 'en'] without opt-in reduces transparency and may misrepresent the user environment to websites. While lower severity on its own, here it is part of a broader stealth profile used to evade fingerprinting and detection.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 76% confidence

Finding

The skill instructs users to run npx agentbridge, which can fetch and execute code from the registry at runtime without an explicitly pinned version. That increases supply-chain risk because users may unknowingly run a newly published or compromised package version when following the documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.