Agent Browser Zh

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:02 PM UTC
• Version: 0.2.2

Overview

This browser automation skill is coherent, but it documents saved login sessions, cookies, screenshots, network capture, and mutable global installs without enough scoping or safety guidance.

Install only if you are comfortable giving an agent browser-control capability over the pages you direct it to use. Prefer an isolated, unprivileged browser profile or container; pin the agent-browser package or Git commit before installation; treat auth.json, screenshots, recordings, traces, cookies, storage dumps, and network logs as secrets; do not commit or share them; and delete session files when the task is done.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned Third-Party Package Installation Creates a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `SKILL.md:17-18`, `SKILL.md:24-28`, and `CONTRIBUTING.md:17` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:17-18`: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` `SKILL.md:24-28`: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build agent-browser install ``` `CONTRIBUTING.md:17`: ```bash npm install -g agent-browser@latest ``` ### Technical Analysis The installation instructions retrieve and execute mutable third-party software without pinning it to a reviewed npm package version, immutable Git commit, or verified artifact digest. The contributing guide explicitly installs `agent-browser@latest`, while the main installation command implicitly selects the package version currently resolved by npm. The source installation alternative clones the repository's mutable default branch and installs its dependency graph before running a build. Consequently, the code executed by these commands can change after this skill has been reviewed. npm installation may also execute package lifecycle scripts, and the source build executes scripts defined by the downloaded project and its dependencies. Global installation increases the potential scope of filesystem changes. The `agent-browser install --with-deps` command may additionally install browser or operating-system dependencies, potentially increasing its privilege and system impact depending on the upstream implementation and the privileges used by the operator. The package and repository names are consistent with the skill's declared browser-automation purpose. There is no evidence in the reviewed files that the current upstream package is malicious, that typosquatting is occurring, or that this project intentionally retrieves a malicious payload. The issue is the absence of dependency immuta ...[truncated 1963 chars]
• Remediation: ## Remediation Suggestions 1. Pin the npm dependency to a specific reviewed version instead of using an implicit current version or `@latest`: ```bash npm install -g agent-browser@<reviewed-version> ``` 2. Record and verify the npm package integrity digest or provenance before installation. Where supported, require registry provenance/signature verification and document the expected package identity. 3. Pin source installations to an immutable, reviewed Git commit: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout --detach <reviewed-commit-sha> ``` 4. Commit and enforce a lockfile for source builds. Use a frozen installation mode so dependency resolution cannot silently change: ```bash pnpm install --frozen-lockfile ``` 5. Avoid global installation where practical. Prefer a dedicated, unprivileged environment, container, or project-local installation with narrowly scoped filesystem access. 6. Do not recommend running installation commands as an administrator unless strictly necessary. Document which operations performed by `agent-browser install --with-deps` require elevated privileges and allow users to review those operations before authorization. 7. Separate dependency installation from execution and require review when the pinned version or commit changes. 8. Add an update procedure that validates new releases, lockfile changes, package lifecycle scripts, and upstream ownership before updating the documented pin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The skill name and description explicitly identify this as a Chinese localized version, but the document does not indicate that the user can choose another language or that the locale restriction is required for a region-specific use case. This can violate language/locale policy when a skill imposes a specific language without opt-in.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill documents screenshots, PDFs, video capture, console/error collection, storage inspection, cookies, and network request inspection without any privacy or data-handling warning. These features can capture page contents, credentials, tokens, personal data, and internal application details, and an agent may over-collect or retain this information unintentionally.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly documents saving and reusing authenticated browser state (`auth.json`) but gives no warning that these files can contain cookies, tokens, and other session artifacts that may grant account access if copied or leaked. In an agent skill, this is particularly risky because agents may store artifacts in shared workspaces, logs, or repositories where sensitive session data can persist beyond the intended task.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 93% confidence
• Finding: Session persistence is a real security concern here because the skill encourages saving and later loading browser session state without safeguards. Persisted state can preserve authenticated access across runs, enabling account takeover or lateral misuse if the file is exposed to other users, agents, or processes.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 93% confidence
• Finding: The example normalizes reusing previously saved authenticated state in later sessions, which increases the chance that operators or agents will retain long-lived session artifacts insecurely. In the context of browser automation, these artifacts may bypass login controls and expose authenticated environments if copied, archived, or committed.

Static analysis

No suspicious patterns detected.