Agent Browser Bwm

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:07 AM UTC
• Version: 1.0.0

Overview

This is a coherent browser automation skill, but users should treat its saved browser state and cookie/storage commands as sensitive.

Install only from a trusted npm registry or pin a reviewed agent-browser version where possible. Treat auth state files, cookies, and browser storage like passwords: keep them private, use least-privilege test accounts, avoid logging their contents, and delete saved state when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:195

Finding

Unpinned Global Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 195-197
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

npm install -g agent-browser
agent-browser install                     # Download Chromium
agent-browser install --with-deps         # Linux: + system deps

Technical Analysis

The installation instructions globally install agent-browser without specifying a reviewed version or verifying package integrity. Consequently, the package and any npm lifecycle scripts executed are determined by the registry contents available at installation time rather than the version reviewed during this audit.

The subsequent agent-browser install command downloads Chromium, while agent-browser install --with-deps may also change system-level dependencies. The instructions do not pin the npm package, verify checksums or signatures for downloaded artifacts, identify an immutable trusted source, or describe the system changes performed by --with-deps.

Although no malicious package code is included in this project, these instructions create an avoidable supply-chain exposure in which a compromised, replaced, or unexpectedly updated dependency could execute code.

Attack Path

1. An attacker compromises the relevant npm package, its publisher account, registry distribution path, or a downloaded browser artifact.
2. The attacker publishes or serves a modified version containing a malicious lifecycle script, CLI implementation, or browser component.
3. A user follows the documented npm install -g agent-browser instruction without a version constraint.
4. npm retrieves the attacker-controlled version and may execute its lifecycle scripts during global installation.
5. The user runs agent-browser install or agent-browser install --with-deps, permitting additional components—and potentially system dependencies—to be downloaded or installed.
6. The malicious code ...[truncated 711 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin agent-browser to an explicitly reviewed version rather than installing the latest available release:

   bash

   npm install -g agent-browser@<reviewed-version>
   

2. Prefer a project-local installation governed by a committed lockfile over a global installation.
3. Verify package provenance and integrity through registry metadata, npm provenance attestations, signatures, or published checksums.
4. Pin and verify downloaded Chromium artifacts rather than relying on mutable upstream downloads.
5. Document the exact trusted npm registry and reject unexpected registry overrides.
6. Review npm lifecycle scripts and the implementation of the browser installer before recommending execution.
7. Avoid --with-deps unless the required system changes have been enumerated and reviewed. Run it with the minimum necessary privileges.
8. Consider distributing a reproducible, integrity-verified installation procedure or a vetted artifact instead of fetching mutable dependencies during setup.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly encourages saving and loading browser auth state from files but does not warn that these files can contain active session cookies and local storage tokens. In an agent context, this can lead to credential/session theft, accidental reuse across tasks, or persistence of privileged access beyond the intended workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation exposes commands to read and modify cookies and browser storage without any privacy or integrity warning. In a browser-automation skill, these primitives can disclose sensitive tokens, bypass normal login boundaries, tamper with application state, or facilitate account takeover if used on authenticated sessions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.