Agent Browser Juan

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:13 AM UTC
• Version: 0.2.2

Overview

This skill is a coherent browser automation wrapper, but it exposes powerful authenticated browser, storage, network, and session-reuse capabilities without enough guardrails.

Review this before installing if you plan to use it on real accounts. Prefer pinned and isolated installation, avoid running install steps with elevated privileges, scope each browser task to a specific site, require confirmation before form submission or account changes, and treat saved state, screenshots, PDFs, videos, traces, cookies, and storage dumps as sensitive secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20
• Finding: Unpinned Third-Party Package and Source Installation## Vulnerability Details **File Location**: `SKILL.md:20-35`, `CONTRIBUTING.md:21-25`, `skills/agent-browser-juan/SKILL.md:15-30`, and `skills/agent-browser-juan/CONTRIBUTING.md:21-25` **Vulnerability Type**: Mutable and unverified third-party dependency installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:20-35`: ```bash ### npm recommended ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` ### From Source ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build agent-browser install ``` ``` The same installation workflow is duplicated in `skills/agent-browser-juan/SKILL.md:15-30`. `CONTRIBUTING.md:21-25`: ```bash 1. Install the latest version ```bash npm install -g agent-browser@latest ``` ``` The `@latest` installation instruction is duplicated in `skills/agent-browser-juan/CONTRIBUTING.md:21-25`. ### Technical Analysis The documented installation procedures retrieve and execute mutable third-party content without pinning it to a reviewed package version, source commit, or integrity hash. `npm install -g agent-browser` implicitly resolves the current registry version, while `npm install -g agent-browser@latest` explicitly follows a mutable distribution tag. npm installation can execute package lifecycle scripts with the privileges of the invoking user. Installing globally also places package executables and files into shared user-level or system-level locations. The source installation procedure clones the repository's current default branch rather than a reviewed commit or signed release tag. It then resolves dependencies through `pnpm install` and executes the upstream build. Consequently, the code executed by users can differ from the code that was available when this Skill was audited. Finally, `agent-browser install --with-deps` may download browser componen ...[truncated 2336 chars]
• Remediation: ## Remediation Suggestions 1. Pin the npm dependency to a specific audited version instead of resolving an implicit current version or `@latest`: ```bash npm install -g agent-browser@X.Y.Z ``` 2. Verify the selected release against a documented integrity hash, package signature, or trusted provenance attestation before installation. 3. Pin source installations to a reviewed commit hash: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout --detach VERIFIED_COMMIT_HASH ``` 4. Provide and enforce a committed lockfile for source builds. Use a frozen-lockfile installation mode so dependency resolution fails rather than silently updating: ```bash pnpm install --frozen-lockfile ``` 5. Review package lifecycle scripts and use script-disabled installation where compatible. If scripts are required, document exactly which scripts execute and why. 6. Avoid global installation when practical. Prefer an isolated container, dedicated virtual environment, or project-local installation with restricted filesystem and network access. 7. Separate browser installation from operating-system dependency installation. Explain that `--with-deps` can alter the host and require explicit user confirmation before invoking it. 8. Do not recommend installation with administrative privileges unless strictly necessary. If elevated installation is unavoidable, enumerate the exact packages and commands requiring elevation. 9. Keep the root and nested documentation copies synchronized so all installation paths use the same pinned and verified release. 10. Establish a dependency update process in which version changes, lockfile changes, checksums, and upstream release provenance are reviewed before the Skill documentation is updated.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill's activation guidance is overly broad for a powerful browser automation tool, making it likely to be invoked in many common web tasks without requiring explicit user consent, scope checks, or safety constraints. Because the skill can navigate, fill forms, manipulate storage/cookies, and execute JavaScript, broad triggering increases the chance of unintended actions on sensitive sites or workflows.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation exposes sensitive capabilities like file upload, cookie/storage manipulation, credential setting, JavaScript execution, and network interception without any warning about privacy, account compromise, or destructive side effects. In an agent setting, omission of such guardrails can lead to credential leakage, unintended state changes, or unauthorized actions against live web applications.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 91% confidence
• Finding: Session state save/load enables persistence and reuse of authenticated browser context, which can include cookies, tokens, and other sensitive session artifacts. If the saved state file is mishandled, shared, or reused across tasks, an attacker or unintended process could gain account access without credentials.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 95% confidence
• Finding: The example explicitly encourages loading previously saved authentication state in later sessions, normalizing reuse of bearer session material without discussing trust boundaries or storage protections. In agent workflows, this increases the risk of silent account takeover, cross-task privilege leakage, and persistence beyond the user's intended session.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill advertises broad `read_when` triggers such as automating web interactions, extracting data, filling forms, and testing UIs, which are common tasks across many workflows. This can cause the skill to be invoked in contexts where browser automation is unnecessary, increasing the chance an agent uses powerful navigation, state, and credential-handling features on sensitive sites without explicit user intent.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill documents screenshots, PDFs, and recordings without warning that these artifacts can capture page contents, credentials, personal data, and authenticated application state, then write them to disk. In agent environments, such files may persist beyond the task, be indexed, uploaded, or accessed by other processes, creating unintended data leakage.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This section documents features for credentials, cookies, storage, auth state, and request inspection, but it does not warn that these may expose secrets, session tokens, or personal data. In an agent skill, omission of such warnings is risky because users or downstream agents may save, replay, or disclose sensitive browser state without recognizing the security implications.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 93% confidence
• Finding: `state save` and `state load` enable persistent reuse of authenticated browser state, which commonly includes cookies and other session material. If the saved file is stored insecurely, reused across tasks, or loaded in the wrong context, it can enable account/session hijacking or cross-task leakage of authenticated access.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 95% confidence
• Finding: The authentication example explicitly encourages saving login state to `auth.json` and reloading it later, normalizing persistence of active authenticated sessions without any warning. In the context of an agent browser skill, this is particularly dangerous because it makes durable session artifacts part of routine workflow and increases the chance of credential-equivalent leakage.

Static analysis

No suspicious patterns detected.