Agent Browser Clawdbot 0

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:23 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is coherent, but it asks agents to handle saved login sessions, cookies, network traffic, and global installs without enough safety guidance.

Review before installing. Use this only in isolated projects or test environments, pin and verify the CLI where possible, avoid broad system dependency installation unless necessary, and treat saved auth files, cookies, storage, and captured network data as secrets that should not be committed, shared, or reused across unrelated sites/accounts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:194

Finding

Unpinned Global Dependency Installation and Unverified Secondary Downloads

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 194-200
Vulnerability Type: Unpinned third-party dependency and externally retrieved browser/system components
Risk Level: Medium

Vulnerable Code

bash

## Installation

```bash
npm install -g agent-browser
agent-browser install                     # Download Chromium
agent-browser install --with-deps         # Linux: + system deps

text

### Technical Analysis

The installation instructions globally install `agent-browser` from the npm registry without specifying an exact version or integrity digest. Consequently, the installed code is determined by mutable registry state at installation time rather than by a version reviewed with this Skill.

The installed CLI is subsequently instructed to download Chromium. The `--with-deps` variant may also install or modify operating-system dependencies. The instructions do not provide checksums, signatures, expected package metadata, or other controls for verifying these secondary artifacts.

npm package installation can execute package lifecycle logic with the invoking user's permissions. The downloaded CLI and browser components are also trusted for later execution. Although the documentation attributes the CLI to a plausible public project, the commands do not cryptographically bind the installed artifacts to a reviewed release. No evidence establishes that the current package is malicious; the vulnerability is the unsafe and mutable supply-chain trust model.

### Attack Path

1. An attacker compromises the npm package, one of its transitive dependencies, its publisher account, or a future package release.
2. A user follows the Skill's installation instructions at a time when the compromised release is selected.
3. `npm install -g agent-browser` downloads and installs the mutable package globally.
4. Malicious package lifecycle code or installed CLI code executes with the invoking user's permissions.
...[truncated 1018 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin agent-browser to an exact, reviewed version rather than allowing npm to resolve the latest release.
2. Record and verify the npm package integrity digest through a lockfile or an equivalent reproducible dependency mechanism.
3. Prefer a project-local installation over a global installation so that dependency scope and executable resolution remain isolated to the project.
4. Use an isolated, non-privileged environment such as a container or dedicated service account for installation and browser execution.
5. Disable or strictly control npm lifecycle scripts during installation where compatible with the package's documented requirements.
6. Verify the package publisher, registry URL, provenance attestations, and release signatures before installation.
7. Pin the Chromium revision downloaded by the CLI and verify its checksum or signature against a trusted source.
8. Avoid --with-deps unless system dependencies are necessary. If required, review the exact package changes first and use a controlled package-management process rather than granting broad elevation to an unverified installer.
9. Document the expected package version, artifact hashes, supported Chromium revision, and update-review procedure directly in the Skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly documents saving/loading auth state, cookies, and storage data, which are sensitive session artifacts that can enable account takeover or unauthorized access if mishandled. In an agent-oriented automation skill, presenting these capabilities without clear safeguards or warnings increases the chance that users or downstream agents will persist secrets insecurely or reuse them across contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill advertises network interception, request inspection, and response mocking without noting that these actions can expose sensitive request data, alter application behavior, or affect testing environments in unexpected ways. While these features are legitimate for automation, the lack of privacy and environment-impact guidance makes accidental misuse more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.