ClawHub
Back to skill

Security audit

Agent Browser.Skip

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is mostly coherent, but it needs Review because it encourages reusable authenticated browser state and mutable global installation without enough safety guidance.

Install only from a version or commit you trust, avoid running the installer with administrative privileges, and treat any saved browser state, recordings, traces, screenshots, PDFs, cookies, and storage dumps as sensitive credentials or private data. Use test accounts or isolated browser sessions where possible, never commit auth.json or captured artifacts, and review agent-browser actions before allowing them on important accounts or production systems.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Unpinned Third-Party Package and Source Installation

Content
View full analysis
Remediation
View remediation
``` 2. Document and verify the expected package integrity digest before installation. 3. For source installation, check out a reviewed immutable commit or signed release: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout ``` 4. Verify release signatures or commit signatures when the upstream project provides them. 5. Use a committed lockfile with immutable dependency versions for source builds, and use the package manager's frozen-lockfile mode. 6. Avoid global or administrative installation where possible. Run the tool under a dedicated, least-privileged account or isolated environment. 7. Separate operating-system dependency installation from ordinary package setup. Clearly disclose when elevation may be requested and enumerate the packages to be installed. 8. Establish an explicit update-review process so that a new package version or Git commit is security-reviewed before the documented pin is changed. ]]>

T08 · Insecure Dependencies

Warning
Location
CONTRIBUTING.md:23
Finding

Contributor Guidance Explicitly Installs the Mutable Latest Release

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation promotes screenshots, PDFs, video recording, traces, and debugging artifacts without warning that these outputs may capture credentials, personal data, tokens, page contents, or internal application details. In browser automation for AI agents, these artifacts are especially likely to be stored, forwarded, or parsed automatically, increasing the chance of inadvertent data leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly demonstrates saving and reusing authenticated browser state but provides no warning that session state files can contain cookies, tokens, and other authentication artifacts. In an agent context, that omission can lead users to persist reusable credentials insecurely, enabling account takeover if the file is exposed or reused improperly.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The skill exposes a built-in mechanism to save and reload browser session state, which can preserve authenticated sessions across runs. Without safeguards or warnings, this encourages persistent storage of reusable authentication material, raising the risk of credential/session theft if the saved file is accessed by another user, process, or agent.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The authentication example normalizes saving login state after authenticating and reloading it later, but omits any caution about the sensitivity of the resulting file. In practice, this can train users or agents to create portable session artifacts that bypass normal login controls and can be abused if exfiltrated.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text