ClawHub
Back to skill

Security audit

Agent Browser Custom

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only browser automation skill whose sensitive cookie, storage, and install behaviors are purpose-aligned but need careful handling.

Install only if you trust the agent-browser npm package and are comfortable with a global CLI install. Treat saved state files, cookies, and localStorage output like passwords: keep them out of source control and logs, restrict file permissions, and use isolated sessions for sensitive accounts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:197
Finding
Unpinned Global Installation of a Third-Party Browser Automation Package## Vulnerability Details **File Location**: `SKILL.md`, lines 197-199 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code**: ```bash npm install -g agent-browser agent-browser install # Download Chromium agent-browser install --with-deps # Linux: + system deps ``` ### Technical Analysis The Skill instructs users or agents to install the latest available version of `agent-browser` globally without specifying an audited version, integrity hash, lockfile, or verified artifact source. The installed package is then executed to download Chromium and, optionally, install operating-system dependencies. An npm installation can execute package lifecycle scripts with the permissions of the invoking user. Because no version is pinned, the effective code installed in the future may differ from the version reviewed when this Skill was published. The subsequent browser and system-dependency installation steps expand the dependency chain beyond the files present in this project. This project contains only documentation and metadata; no evidence establishes that the named package is currently malicious. The risk arises from the mutable, unverified supply-chain installation process. ### Attack Path 1. An attacker compromises the npm package, one of its transitive dependencies, its publisher account, or the associated distribution channel. 2. The attacker publishes a modified release containing a malicious lifecycle script or executable payload. 3. A user or agent follows the Skill instructions and runs `npm install -g agent-browser` without a pinned version. 4. npm retrieves the attacker-controlled release and may execute its lifecycle scripts during installation. 5. The user invokes `agent-browser install` or `agent-browser install --with-deps`, executing additional code and downloading further components. 6. The payload operates with the invoking user's permissi ...[truncated 827 chars]
Remediation
## Remediation Suggestions 1. Pin `agent-browser` to an explicitly reviewed version rather than installing the latest release: ```bash npm install --save-dev --save-exact agent-browser@REVIEWED_VERSION ``` 2. Prefer a project-local installation over `npm install -g` and invoke it through a package script or a version-pinned local executable. 3. Commit a lockfile and use a reproducible installation command such as `npm ci`. 4. Verify registry provenance and package integrity, and document the expected npm registry, publisher, repository, package digest, and release version. 5. Review lifecycle scripts and transitive dependencies before installation. Where compatible with the package's installation model, disable lifecycle scripts during dependency retrieval and run only explicitly reviewed setup steps. 6. Pin and verify downloaded browser artifacts rather than accepting a mutable Chromium download without documented integrity validation. 7. Avoid `--with-deps` by default. Document the exact operating-system packages it installs and require explicit user approval before any privileged system modification. 8. Perform installation and browser execution in a least-privileged container, virtual machine, or dedicated service account without access to unrelated credentials or sensitive host files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly recommends saving and loading browser state files for authentication reuse, but it does not warn that these files can contain session cookies, local storage tokens, and other sensitive authentication artifacts. In an agent-oriented workflow, this increases the chance that operators store auth material insecurely, reuse it across contexts, or expose it to other tools, leading to account compromise if the state file is leaked.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documented cookie and local storage commands expose direct access to highly sensitive browser data, including session identifiers and application tokens, without any caution about secrecy, least privilege, or handling constraints. In a skill meant for AI agents, this is especially risky because agents may read, log, transform, or persist these values automatically, creating unintended credential disclosure paths.

Static analysis

No suspicious patterns detected.