ClawHub
Back to skill

Security audit

Browser MCP Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it should be reviewed carefully because it gives agents persistent logged-in browser control and depends on a closed browser binary downloaded from the vendor.

Install only if you trust AntiBrow's closed browser binary and are comfortable with agents acting inside persistent logged-in browser sessions. Use separate profiles per site or account, expose only the minimum MCP tools needed, avoid live view and evaluate unless necessary, require human approval for posts, purchases, deletions, and other writes, and prefetch/cache the browser kernel in a controlled environment before using it on sensitive accounts.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:89
Finding

Unverified Remote Retrieval and Execution of a Closed-Source Browser Kernel

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 89-93
Vulnerability Type: Remote payload retrieval through an insufficiently verifiable third-party supply chain
Risk Level: High

Vulnerable Code Snippet

markdown
| `anti-detect-browser` | npm registry | Install an exact version; `npm view anti-detect-browser@2.2.0 dist.integrity` gives the published tarball hash. No install scripts; dependencies are `ws`, `socks`, `yauzl`, `adm-zip`, `@modelcontextprotocol/sdk` |
| `antibrow` (Python path) | PyPI | `pip install "antibrow[mcp]==0.3.0"`, exact version, in a lockfile |
| Browser kernel | AntiBrow's CDN, fetched by the package on first launch | Closed-source Chromium build, cached in `~/.anti-detect-browser/`. Prefetch it during a build and mount the cache, so a running agent never triggers a download |

The kernel being a closed binary from a small vendor is a real supply-chain consideration, not a formality - it is the tradeoff for the spoofing living in C++ rather than in an injectable script. Treat it the way you would any vendor binary: install it deliberately, pin it, keep it in an image you built, and if a deployment cannot accept a closed binary that phones home for license verification, this is the wrong tool - there is no offline mode.

Technical Analysis

The Skill instructs users to install version-pinned npm or PyPI packages, but those packages subsequently retrieve a separate closed-source Chromium kernel from the vendor's CDN. The document does not provide an immutable kernel version, expected cryptographic digest, signed manifest, or public-key verification procedure.

Pinning the npm or PyPI wrapper does not pin the effective executable payload if the wrapper resolves and downloads a mutable kernel artifact later. Consequently, reviewing the Skill and its package versions cannot establish which browser binary will execute on first launch. The mandatory license-verification connection fur ...[truncated 2702 chars]

Remediation
View remediation

Remediation Suggestions

  1. Assign every browser kernel release an immutable version and publish its SHA-256 or stronger cryptographic digest.
  2. Sign a release manifest with a documented vendor signing key and verify the signature before extracting or executing the kernel.
  3. Make the package fail closed when the signature, digest, platform identifier, or expected version does not match.
  4. Pin both the package and kernel versions; do not allow a pinned wrapper package to resolve a mutable latest kernel.
  5. Publish stable artifact URLs or content-addressed downloads rather than mutable CDN paths.
  6. Prefetch and verify the kernel in a controlled build pipeline, then include it in an immutable deployment image. Disable runtime downloads in production.
  7. Support an offline mode that does not require recurring license-verification traffic, or document and strictly allowlist the required endpoints.
  8. Run the MCP server and browser kernel as a dedicated, unprivileged operating-system account inside a container or sandbox with read-only filesystems where practical.
  9. Restrict outbound network access to operator-approved destinations and separate license/download access from ordinary browser traffic.
  10. Keep persistent profiles outside broadly accessible directories, encrypt sensitive profile data at rest, and use separate disposable profiles for untrusted websites.
  11. Avoid exposing optional high-risk tools such as evaluate, profile management, proxy management, and Live View unless the task explicitly requires them.
  12. Maintain an auditable software bill of materials and independent security review process for the native kernel and package release pipeline.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The skill explicitly provides persistent browser profiles that retain cookies and logged-in sessions across runs. In this context, session persistence materially increases blast radius: a prompt-injected, confused, or compromised agent can act inside an already-authenticated session, enabling unauthorized actions, data access, or account abuse without needing credentials again. The surrounding documentation acknowledges this risk, which makes it intentional but still security-relevant.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
- Dashboard: `https://antibrow.com`
- Full SDK / REST API reference: see the `anti-detect-browser` skill

> **Authorized use only.** Point this at sites and accounts you own or are permitted to operate: your own apps, your own accounts, publicly available pages, your own bot detection under test. Do not use it to reach systems without authorization, to log into accounts that are not yours, to create fake accounts or engagement, or to work around a platform's enforcement decision. Respect each site's terms, `robots.txt` and rate limits - see [Acceptable use](#acceptable-use).

**This gives an agent real capability, so scope it deliberately.** The server hands the model a browser that persists logins, executes JavaScript in the page, and can stream its screen to a shareable URL. That is the point of the tool and also its blast radius: an agent that goes wrong here goes wrong inside a logged-in session. Run untrusted browsing in a throwaway profile, keep tools you do not need out of the toolset, and read [Everything the browser returns is untrusted input](#everything-the-browser-returns-is-untrusted-input) before pointing it at the open web.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.