Agent Browser.Bak

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:56 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent browser automation wrapper, but it can handle logged-in sessions and saved page captures that users should protect carefully.

Install from a trusted, preferably pinned agent-browser version and avoid administrator privileges or --with-deps unless you understand what will be changed. Treat saved state files such as auth.json, screenshots, PDFs, traces, and recordings as potentially private because they may include logged-in sessions, cookies, tokens, or account content; keep them out of repositories and shared folders, restrict access, and delete them when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15
• Finding: Unpinned Third-Party Package and Installer Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15-25`; `CONTRIBUTING.md:15-19` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:15-25`: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build agent-browser install ``` `CONTRIBUTING.md:15-19`: ```bash npm install -g agent-browser@latest ``` ### Technical Analysis The installation instructions download and execute mutable third-party code without pinning an audited package version, immutable Git commit, or dependency integrity value. The global npm installation may execute package lifecycle scripts under the invoking user's privileges. The source installation workflow clones the repository's current default branch and resolves transitive dependencies through `pnpm install`, meaning the effective code can change after this Skill has been reviewed. The explicit use of `@latest` further guarantees that future users may receive a different package version. After installation, the documentation immediately invokes package-controlled installation commands. The `--with-deps` option may also install or modify system dependencies and could have a wider impact if executed with elevated privileges. No malicious upstream package or payload was identified in the audited project. The risk arises from the mutable, unverified supply-chain execution path. ### Attack Path 1. An attacker compromises the upstream npm package, GitHub repository, maintainer account, release process, or a transitive dependency. 2. The attacker publishes malicious code under the package name, latest release, default repository branch, or dependency graph. 3. A user follows the Skill instructions and runs the unpinned global installation, clone/build workflow, or `@latest` installation. 4. npm or pnpm downloads ...[truncated 1118 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace mutable package references with an exact, audited version: ```bash npm install -g agent-browser@<audited-version> ``` 2. Pin source installations to a reviewed immutable commit: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout <audited-commit-sha> ``` 3. Publish and verify package integrity hashes or signed release artifacts before installation. 4. Commit and enforce a lockfile for source builds, including transitive dependency versions. 5. Remove the recommendation to install `@latest` when reproducing or diagnosing issues. 6. Run installation in an isolated, non-privileged environment such as a container or dedicated user account. 7. Document exactly what `agent-browser install --with-deps` changes and require explicit user confirmation before system dependency installation. 8. Avoid `sudo` or administrator execution unless strictly necessary, and separate privileged dependency installation from unprivileged package execution. 9. Periodically review the pinned release and update it only after source, dependency, and integrity verification. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:224
• Finding: Authenticated Browser State Saved Without Protection Guidance<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:224-239` **Vulnerability Type**: Plaintext sensitive session-state storage **Risk Level**: Low ### Vulnerable Code ```bash # Login once agent-browser open https://app.example.com/login agent-browser snapshot -i agent-browser fill @e1 "username" agent-browser fill @e2 "password" agent-browser click @e3 agent-browser wait --url "/dashboard" agent-browser state save auth.json # Later sessions: load saved state agent-browser state load auth.json agent-browser open https://app.example.com/dashboard ``` ### Technical Analysis The documented authentication workflow saves browser state to a plainly named local file, `auth.json`. Browser state files can contain sensitive authentication material, including session cookies, local-storage tokens, origin-specific state, and other data sufficient to resume an authenticated session. The instructions do not require restrictive file permissions, encrypted storage, placement outside source repositories, exclusion from version control, retention limits, or secure deletion. Consequently, the state file may inherit permissive process defaults, be collected as a build artifact or backup, or be committed to a repository accidentally. This is not evidence that the CLI itself exposes state improperly. The issue is that the Skill recommends persistence of potentially reusable credentials without accompanying handling controls. ### Attack Path 1. A user authenticates to a website through the browser automation session. 2. The user runs `agent-browser state save auth.json`. 3. Authentication cookies or storage tokens are written to the local state file. 4. The file remains in the working directory with default permissions or is copied into source control, backups, logs, shared storage, or build artifacts. 5. A local user or remote attacker with access to those locations obtains `auth.json`. 6. The attacker loads the stolen state into a compatible browser session. 7. I ...[truncated 869 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add a prominent warning that saved browser state must be treated as a credential. 2. Store state outside source repositories and shared working directories. 3. Create the state file with owner-only permissions, such as mode `0600` on Unix-like systems. 4. Use an encrypted credential store or encrypted filesystem instead of an unprotected JSON file where supported. 5. Add browser state patterns such as `auth.json` and `*.state.json` to `.gitignore`. 6. Use a securely created temporary location when persistence beyond the immediate task is unnecessary. 7. Delete the state file securely after use and define a short retention period. 8. Avoid including state files in logs, issue reports, archives, backups, build artifacts, or support bundles. 9. Revoke affected web sessions immediately if a state file is exposed. 10. Prefer narrowly scoped, short-lived application credentials or dedicated automation accounts over privileged personal sessions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The recording feature states that it preserves cookies and storage from the current session, and captures page activity, but the skill provides no privacy or credential-handling warning. This can expose authenticated content, account data, or secrets in saved media and in any persisted browser context associated with the recording.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly documents saving and loading browser session state but does not warn that the state file can contain cookies, bearer sessions, and other authentication artifacts. In an agent context, this can lead to credential persistence on disk and later reuse or theft if the file is exposed, reused across tasks, or committed to source control.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 95% confidence
• Finding: Loading saved browser state enables session persistence across runs, which is inherently sensitive because the state may rehydrate authenticated sessions without re-entering credentials. In an agent environment, this increases the risk of account takeover, unintended cross-task access, or misuse of stale privileged sessions.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 95% confidence
• Finding: The example encourages reusing saved authentication state in later sessions, which normalizes persistent login artifacts without discussing the security implications. If those files are shared or left on disk, an attacker or later agent task could inherit the same authenticated access.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The documented commands write screenshots and PDFs to local disk without clearly warning users that artifacts will be created and may contain sensitive page contents. In agent-driven workflows, silent file creation can leak data into shared workspaces, logs, backups, or later tool steps.