ClawHub
Back to skill

Security audit

Agent Browser.Bak

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent browser automation wrapper, but it can handle logged-in sessions and saved page captures that users should protect carefully.

Install from a trusted, preferably pinned agent-browser version and avoid administrator privileges or --with-deps unless you understand what will be changed. Treat saved state files such as auth.json, screenshots, PDFs, traces, and recordings as potentially private because they may include logged-in sessions, cookies, tokens, or account content; keep them out of repositories and shared folders, restrict access, and delete them when no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Third-Party Package and Installer Execution

Content
View full analysis
Remediation
View remediation
``` 2. Pin source installations to a reviewed immutable commit: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout ``` 3. Publish and verify package integrity hashes or signed release artifacts before installation. 4. Commit and enforce a lockfile for source builds, including transitive dependency versions. 5. Remove the recommendation to install `@latest` when reproducing or diagnosing issues. 6. Run installation in an isolated, non-privileged environment such as a container or dedicated user account. 7. Document exactly what `agent-browser install --with-deps` changes and require explicit user confirmation before system dependency installation. 8. Avoid `sudo` or administrator execution unless strictly necessary, and separate privileged dependency installation from unprivileged package execution. 9. Periodically review the pinned release and update it only after source, dependency, and integrity verification. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:224
Finding

Authenticated Browser State Saved Without Protection Guidance

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The recording feature states that it preserves cookies and storage from the current session, and captures page activity, but the skill provides no privacy or credential-handling warning. This can expose authenticated content, account data, or secrets in saved media and in any persisted browser context associated with the recording.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly documents saving and loading browser session state but does not warn that the state file can contain cookies, bearer sessions, and other authentication artifacts. In an agent context, this can lead to credential persistence on disk and later reuse or theft if the file is exposed, reused across tasks, or committed to source control.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

Loading saved browser state enables session persistence across runs, which is inherently sensitive because the state may rehydrate authenticated sessions without re-entering credentials. In an agent environment, this increases the risk of account takeover, unintended cross-task access, or misuse of stale privileged sessions.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The example encourages reusing saved authentication state in later sessions, which normalizes persistent login artifacts without discussing the security implications. If those files are shared or left on disk, an attacker or later agent task could inherit the same authenticated access.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The documented commands write screenshots and PDFs to local disk without clearly warning users that artifacts will be created and may contain sensitive page contents. In agent-driven workflows, silent file creation can leak data into shared workspaces, logs, backups, or later tool steps.

Content

No source excerpt is available for this finding.