Agent Browser Clawdbot 0.1.0

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:37 AM UTC
• Version: 0.1.0

Overview

This is a coherent browser automation skill, with expected but sensitive browser-session handling that users should manage carefully.

Install only from the expected agent-browser package and repository, avoid running npm or browser install steps as root, prefer a pinned or project-local install when possible, and treat saved auth files, cookies, and local storage output like passwords or API keys.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:194

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 194-198
Vulnerability Type: Unpinned third-party dependency and unsafe global installation
Risk Level: Medium

bash

## Installation

npm install -g agent-browser
agent-browser install                     # Download Chromium
agent-browser install --with-deps         # Linux: + system deps

Technical Analysis

The installation instructions globally install the latest available version of the third-party agent-browser npm package without pinning a reviewed version or verifying an integrity digest. Consequently, the installed code may differ from the code that existed when this skill was audited.

npm package installation can execute package lifecycle scripts with the privileges of the invoking user. The subsequent agent-browser install commands also execute the newly installed package and download additional browser components. The --with-deps option may install system dependencies and could require elevated privileges, further increasing the consequences of a compromised package release, transitive dependency, npm account, or downloaded artifact.

The project does not itself contain an embedded malicious payload, obfuscated code, or demonstrated exfiltration mechanism. This finding concerns the avoidable supply-chain exposure introduced by its installation guidance.

Attack Path

1. An attacker compromises the npm package, its publisher account, a transitive dependency, or an associated downloadable artifact.
2. The attacker publishes a malicious release that becomes the version selected by the unpinned npm install -g agent-browser command.
3. A user follows the installation instructions and globally installs the compromised release.
4. Malicious logic executes through npm lifecycle hooks, invocation of the installed CLI, or the browser-component installation process.
5. If the installation is performed with elevated privileges, partic ...[truncated 740 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin agent-browser to an exact, reviewed version rather than resolving the latest release.
2. Use a project-local dependency with a committed lockfile instead of a global installation.
3. Verify package provenance, npm publisher identity, integrity hashes, and release signatures where available.
4. Disable npm lifecycle scripts during installation when they are unnecessary, and separately review any scripts that must be enabled.
5. Pin and verify downloaded Chromium artifacts or rely on a trusted package-management channel with integrity enforcement.
6. Run installation and browser automation in a sandboxed container or disposable environment with least-privilege permissions.
7. Avoid running npm or the CLI as root. If operating-system dependencies are required, install a documented and reviewed package list through the system package manager rather than granting broad elevation to a third-party CLI.
8. Document the expected upstream repository and package publisher so users can detect package substitution or ownership changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly recommends saving and loading browser auth state files to skip login flows, but it does not warn that these files can contain session cookies, tokens, and other persistent authentication artifacts. In an agent context, this increases the chance that sensitive state is stored insecurely, reused across tasks, or exposed to other users/processes, enabling account takeover if the file is leaked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents commands for enumerating cookies and local storage values without any caution that these sources often contain session identifiers, CSRF tokens, PII, or API credentials. Because this skill is designed for AI agents, exposing easy retrieval of that data without guardrails materially raises the risk of inadvertent secret extraction, logging, or exfiltration.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.