Agent Browser

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:22 AM UTC
• Version: 0.2.3

Overview

The skill has a legitimate browser-automation purpose, but it under-discloses sensitive session-state and supply-chain risks.

Review before installing. Pin and verify the agent-browser package where possible, avoid elevated installs unless truly needed, and treat auth.json, cookies, localStorage dumps, screenshots, PDFs, videos, and traces as secrets. Do not store saved auth state in shared directories or repositories, and avoid reusing it across unrelated tasks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19
• Finding: Unpinned Global Installation of a Mutable Third-Party Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:19-23`; additional occurrence at `CONTRIBUTING.md:23-26` **Vulnerability Type**: Unpinned third-party dependency and mutable package tag **Risk Level**: Medium The installation documentation instructs users to install the `agent-browser` npm package globally without pinning an audited version. The contribution guide additionally recommends the mutable `latest` tag. ### Vulnerable Code `SKILL.md:19-23`: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` `CONTRIBUTING.md:23-26`: ```markdown 1. Install the latest version ```bash npm install -g agent-browser@latest ``` ``` ### Technical Analysis The effective code installed by these commands is determined by the npm registry at installation time rather than by a version reviewed with this Skill. The `latest` tag is explicitly mutable, while omitting a version normally resolves through the same mutable distribution tag. Global npm installation may execute package lifecycle scripts with the permissions of the invoking user. The subsequent `agent-browser install` commands also delegate browser and, when `--with-deps` is used, system-dependency installation to that newly downloaded tool. Consequently, a compromised npm account, malicious package release, compromised distribution tag, or unexpected upstream change could cause code not represented in the audited project to execute locally. The package and repository names shown in the documentation are consistent with the declared browser-automation purpose; the reviewed files contain no evidence that the current upstream package is malicious. The risk arises from the mutable, unverified supply-chain installation process. ### Attack Path 1. An attacker compromises the upstream package publisher, npm account, release pipeline, or mutable `latest` distribution tag. 2. The attacker publishes a modified `agent-browser` release containing a malicio ...[truncated 1291 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `agent-browser` to a specific version that has been reviewed and tested: ```bash npm install -g agent-browser@<audited-version> ``` 2. Remove `@latest` from troubleshooting and contribution instructions. Update the pinned version through an explicit review process rather than resolving a mutable tag at installation time. 3. Document verification of package provenance and integrity, such as checking npm provenance attestations, expected package metadata, and published integrity hashes before installation. 4. Prefer a project-local dependency with a lockfile over a global installation where practical. Commit and review the lockfile so transitive dependency changes are visible. 5. Advise users not to run npm or `agent-browser install --with-deps` as root unless system dependencies genuinely require elevation. Separate privileged operating-system package installation from unprivileged npm package execution. 6. In automated environments, use a restricted container or sandbox with minimal filesystem access, no unrelated credentials, and constrained network permissions. 7. Review installer behavior and upstream release changes before updating the pinned version, including npm lifecycle scripts and any resources downloaded by `agent-browser install`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill promotes screenshots, PDFs, video recordings, and traces without warning that these files can capture visible secrets, personal data, session identifiers, and internal application content. In a browser automation skill, capture features are especially risky because agents may operate on authenticated pages and automatically write sensitive data to local storage or logs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly documents saving and loading authentication/session state and setting credentials, but it does not warn that these artifacts may contain cookies, tokens, or passwords that can be reused to impersonate a user. In an agent context, this is dangerous because an LLM or automation workflow may persist secrets to disk or reload privileged state across tasks without the operator realizing the exposure.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 95% confidence
• Finding: The documented ability to save and later reload browser state enables session persistence across runs, which can expose authenticated cookies and tokens if the state file is copied, reused, or left unsecured. In an agent-operated browser, this increases risk because the agent may carry privileged sessions into unintended tasks or environments.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 96% confidence
• Finding: The example normalizes reusing saved authenticated state for later sessions without caution about credential replay, privilege carryover, or accidental sharing of auth.json. That is a real security concern because anyone or any process with access to the file may be able to access the authenticated account without re-entering credentials.

Static analysis

No suspicious patterns detected.