Agent Browser.Skip

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:12 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is mostly coherent, but it needs Review because it encourages reusable authenticated browser state and mutable global installation without enough safety guidance.

Install only from a version or commit you trust, avoid running the installer with administrative privileges, and treat any saved browser state, recordings, traces, screenshots, PDFs, cookies, and storage dumps as sensitive credentials or private data. Use test accounts or isolated browser sessions where possible, never commit auth.json or captured artifacts, and review agent-browser actions before allowing them on important accounts or production systems.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18
• Finding: Unpinned Third-Party Package and Source Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:18-32` **Vulnerability Type**: Unpinned and unverified third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash ### npm recommended ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` ### From Source ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build agent-browser install ``` ``` ### Technical Analysis The documented installation procedures retrieve executable third-party content without pinning it to a reviewed, immutable version or commit. The npm procedure installs the package globally using its currently resolved registry version. It then executes the installed package's browser and dependency installation commands. The source procedure clones the repository's current default branch rather than a specific commit or signed release and subsequently installs dependencies and runs the build. Neither procedure documents package integrity hashes, an immutable Git commit, signature verification, or another mechanism that ensures the installed content is identical to the content reviewed during this audit. Consequently, the effective installation payload can change after the Skill has been published and audited. The `--with-deps` option may also install operating-system dependencies. Depending on the upstream implementation and the privileges under which the command is invoked, this can increase the installation's system-level effect. ### Attack Path 1. An attacker compromises the upstream npm package, repository, maintainer account, release process, or a transitive dependency. 2. The attacker publishes malicious code under the package's currently resolved release or modifies the repository's default branch. 3. A user follows the installation commands in `SKILL.md`. 4. npm or Git retrieves content that differs from the version originally reviewed. 5. The user exec ...[truncated 882 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the npm dependency to a reviewed exact version rather than relying on the registry's current release: ```bash npm install -g agent-browser@<reviewed-exact-version> ``` 2. Document and verify the expected package integrity digest before installation. 3. For source installation, check out a reviewed immutable commit or signed release: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout <reviewed-commit-hash> ``` 4. Verify release signatures or commit signatures when the upstream project provides them. 5. Use a committed lockfile with immutable dependency versions for source builds, and use the package manager's frozen-lockfile mode. 6. Avoid global or administrative installation where possible. Run the tool under a dedicated, least-privileged account or isolated environment. 7. Separate operating-system dependency installation from ordinary package setup. Clearly disclose when elevation may be requested and enumerate the packages to be installed. 8. Establish an explicit update-review process so that a new package version or Git commit is security-reviewed before the documented pin is changed. ]]>

T08 · Insecure Dependencies

Warning

• Location: CONTRIBUTING.md:23
• Finding: Contributor Guidance Explicitly Installs the Mutable Latest Release<![CDATA[ ## Vulnerability Details **File Location**: `CONTRIBUTING.md:23-26` **Vulnerability Type**: Mutable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash 1. Install the latest version ```bash npm install -g agent-browser@latest ``` ``` ### Technical Analysis The contributor instructions explicitly direct users to install the `latest` npm distribution tag globally. A distribution tag is mutable and can be redirected to a different package release after this project has been audited. The command therefore provides no stable relationship between the dependency reviewed by project maintainers and the dependency subsequently installed by contributors. Global npm installation also makes the package available broadly in the user's environment. Any package installation or lifecycle behavior runs with the invoking user's permissions, and its impact is greater if the user invokes npm through an elevated account. ### Attack Path 1. An attacker compromises the upstream package publication process, npm maintainer credentials, or a dependency included in a newly published release. 2. The malicious release is assigned the `latest` distribution tag. 3. A contributor follows the documented troubleshooting procedure. 4. npm resolves `agent-browser@latest` to the attacker-influenced release and installs it globally. 5. Installation-time or later executable package behavior runs under the contributor's account. ### Impact Assessment A compromised latest release could execute arbitrary code with the contributor's privileges. Accessible resources may include source repositories, development credentials, package registry tokens, SSH material, environment variables, and files available to the contributor account. The project itself does not contain evidence of such malicious behavior; the risk arises because the instructions trust a mutable future release without integrity or version constraints. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed version. 2. Publish the expected integrity hash and provide verification instructions. 3. Prefer a project-local or isolated installation over a global installation where practical. 4. Test new releases in a sandbox before updating the documented version. 5. Require a dependency review when changing the pinned version, including review of transitive dependency and lifecycle-script changes. 6. Advise contributors not to run npm with administrative privileges. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation promotes screenshots, PDFs, video recording, traces, and debugging artifacts without warning that these outputs may capture credentials, personal data, tokens, page contents, or internal application details. In browser automation for AI agents, these artifacts are especially likely to be stored, forwarded, or parsed automatically, increasing the chance of inadvertent data leakage.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly demonstrates saving and reusing authenticated browser state but provides no warning that session state files can contain cookies, tokens, and other authentication artifacts. In an agent context, that omission can lead users to persist reusable credentials insecurely, enabling account takeover if the file is exposed or reused improperly.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 93% confidence
• Finding: The skill exposes a built-in mechanism to save and reload browser session state, which can preserve authenticated sessions across runs. Without safeguards or warnings, this encourages persistent storage of reusable authentication material, raising the risk of credential/session theft if the saved file is accessed by another user, process, or agent.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 95% confidence
• Finding: The authentication example normalizes saving login state after authenticating and reloading it later, but omits any caution about the sensitivity of the resulting file. In practice, this can train users or agents to create portable session artifacts that bypass normal login controls and can be abused if exfiltrated.

Static analysis

No suspicious patterns detected.