ClawHub
Back to skill

Security audit

Agent Browser

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate browser-automation purpose, but it under-discloses sensitive session-state and supply-chain risks.

Review before installing. Pin and verify the agent-browser package where possible, avoid elevated installs unless truly needed, and treat auth.json, cookies, localStorage dumps, screenshots, PDFs, videos, and traces as secrets. Do not store saved auth state in shared directories or repositories, and avoid reusing it across unrelated tasks.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding

Unpinned Global Installation of a Mutable Third-Party Dependency

Content
View full analysis
Remediation
View remediation
``` 2. Remove `@latest` from troubleshooting and contribution instructions. Update the pinned version through an explicit review process rather than resolving a mutable tag at installation time. 3. Document verification of package provenance and integrity, such as checking npm provenance attestations, expected package metadata, and published integrity hashes before installation. 4. Prefer a project-local dependency with a lockfile over a global installation where practical. Commit and review the lockfile so transitive dependency changes are visible. 5. Advise users not to run npm or `agent-browser install --with-deps` as root unless system dependencies genuinely require elevation. Separate privileged operating-system package installation from unprivileged npm package execution. 6. In automated environments, use a restricted container or sandbox with minimal filesystem access, no unrelated credentials, and constrained network permissions. 7. Review installer behavior and upstream release changes before updating the pinned version, including npm lifecycle scripts and any resources downloaded by `agent-browser install`. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill promotes screenshots, PDFs, video recordings, and traces without warning that these files can capture visible secrets, personal data, session identifiers, and internal application content. In a browser automation skill, capture features are especially risky because agents may operate on authenticated pages and automatically write sensitive data to local storage or logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly documents saving and loading authentication/session state and setting credentials, but it does not warn that these artifacts may contain cookies, tokens, or passwords that can be reused to impersonate a user. In an agent context, this is dangerous because an LLM or automation workflow may persist secrets to disk or reload privileged state across tasks without the operator realizing the exposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The documented ability to save and later reload browser state enables session persistence across runs, which can expose authenticated cookies and tokens if the state file is copied, reused, or left unsecured. In an agent-operated browser, this increases risk because the agent may carry privileged sessions into unintended tasks or environments.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

The example normalizes reusing saved authenticated state for later sessions without caution about credential replay, privilege carryover, or accidental sharing of auth.json. That is a real security concern because anyone or any process with access to the file may be able to access the authenticated account without re-entering credentials.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text