ClawHub
Back to skill

Security audit

Agent Browser Juan

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent browser automation wrapper, but it exposes powerful authenticated browser, storage, network, and session-reuse capabilities without enough guardrails.

Review this before installing if you plan to use it on real accounts. Prefer pinned and isolated installation, avoid running install steps with elevated privileges, scope each browser task to a specific site, require confirmation before form submission or account changes, and treat saved state, screenshots, PDFs, videos, traces, cookies, and storage dumps as sensitive secrets.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned Third-Party Package and Source Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:20-35, CONTRIBUTING.md:21-25, skills/agent-browser-juan/SKILL.md:15-30, and skills/agent-browser-juan/CONTRIBUTING.md:21-25
Vulnerability Type: Mutable and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

SKILL.md:20-35:

bash
### npm recommended

```bash
npm install -g agent-browser
agent-browser install
agent-browser install --with-deps

From Source

bash
git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
pnpm install
pnpm build
agent-browser install
text

The same installation workflow is duplicated in `skills/agent-browser-juan/SKILL.md:15-30`.

`CONTRIBUTING.md:21-25`:

```bash
1. Install the latest version
   ```bash
   npm install -g agent-browser@latest
   ```

The @latest installation instruction is duplicated in skills/agent-browser-juan/CONTRIBUTING.md:21-25.

Technical Analysis

The documented installation procedures retrieve and execute mutable third-party content without pinning it to a reviewed package version, source commit, or integrity hash.

npm install -g agent-browser implicitly resolves the current registry version, while npm install -g agent-browser@latest explicitly follows a mutable distribution tag. npm installation can execute package lifecycle scripts with the privileges of the invoking user. Installing globally also places package executables and files into shared user-level or system-level locations.

The source installation procedure clones the repository's current default branch rather than a reviewed commit or signed release tag. It then resolves dependencies through pnpm install and executes the upstream build. Consequently, the code executed by users can differ from the code that was available when this Skill was audited.

Finally, agent-browser install --with-deps may download browser componen ...[truncated 2336 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the npm dependency to a specific audited version instead of resolving an implicit current version or @latest:

    bash
    npm install -g agent-browser@X.Y.Z

  2. Verify the selected release against a documented integrity hash, package signature, or trusted provenance attestation before installation.

  3. Pin source installations to a reviewed commit hash:

    bash
    git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
git checkout --detach VERIFIED_COMMIT_HASH

  4. Provide and enforce a committed lockfile for source builds. Use a frozen-lockfile installation mode so dependency resolution fails rather than silently updating:

    bash
    pnpm install --frozen-lockfile

  5. Review package lifecycle scripts and use script-disabled installation where compatible. If scripts are required, document exactly which scripts execute and why.

  6. Avoid global installation when practical. Prefer an isolated container, dedicated virtual environment, or project-local installation with restricted filesystem and network access.

  7. Separate browser installation from operating-system dependency installation. Explain that --with-deps can alter the host and require explicit user confirmation before invoking it.

  8. Do not recommend installation with administrative privileges unless strictly necessary. If elevated installation is unavoidable, enumerate the exact packages and commands requiring elevation.

  9. Keep the root and nested documentation copies synchronized so all installation paths use the same pinned and verified release.

  10. Establish a dependency update process in which version changes, lockfile changes, checksums, and upstream release provenance are reviewed before the Skill documentation is updated.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · skills/agent-browser-juan/CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill's activation guidance is overly broad for a powerful browser automation tool, making it likely to be invoked in many common web tasks without requiring explicit user consent, scope checks, or safety constraints. Because the skill can navigate, fill forms, manipulate storage/cookies, and execute JavaScript, broad triggering increases the chance of unintended actions on sensitive sites or workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation exposes sensitive capabilities like file upload, cookie/storage manipulation, credential setting, JavaScript execution, and network interception without any warning about privacy, account compromise, or destructive side effects. In an agent setting, omission of such guardrails can lead to credential leakage, unintended state changes, or unauthorized actions against live web applications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

Session state save/load enables persistence and reuse of authenticated browser context, which can include cookies, tokens, and other sensitive session artifacts. If the saved state file is mishandled, shared, or reused across tasks, an attacker or unintended process could gain account access without credentials.

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The example explicitly encourages loading previously saved authentication state in later sessions, normalizing reuse of bearer session material without discussing trust boundaries or storage protections. In agent workflows, this increases the risk of silent account takeover, cross-task privilege leakage, and persistence beyond the user's intended session.

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises broad read_when triggers such as automating web interactions, extracting data, filling forms, and testing UIs, which are common tasks across many workflows. This can cause the skill to be invoked in contexts where browser automation is unnecessary, increasing the chance an agent uses powerful navigation, state, and credential-handling features on sensitive sites without explicit user intent.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · skills/agent-browser-juan/SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill documents screenshots, PDFs, and recordings without warning that these artifacts can capture page contents, credentials, personal data, and authenticated application state, then write them to disk. In agent environments, such files may persist beyond the task, be indexed, uploaded, or accessed by other processes, creating unintended data leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This section documents features for credentials, cookies, storage, auth state, and request inspection, but it does not warn that these may expose secrets, session tokens, or personal data. In an agent skill, omission of such warnings is risky because users or downstream agents may save, replay, or disclose sensitive browser state without recognizing the security implications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

state save and state load enable persistent reuse of authenticated browser state, which commonly includes cookies and other session material. If the saved file is stored insecurely, reused across tasks, or loaded in the wrong context, it can enable account/session hijacking or cross-task leakage of authenticated access.

Content

Scanner excerpt · skills/agent-browser-juan/SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The authentication example explicitly encourages saving login state to auth.json and reloading it later, normalizing persistence of active authenticated sessions without any warning. In the context of an agent browser skill, this is particularly dangerous because it makes durable session artifacts part of routine workflow and increases the chance of credential-equivalent leakage.

Content

Scanner excerpt · skills/agent-browser-juan/SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Static analysis

No suspicious patterns detected.