ClawHub
Back to skill

Security audit

Agent Browser

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate browser automation helper, but it needs Review because it handles credentials, reusable browser sessions, existing Chrome profiles, local files, arbitrary page JavaScript, and unpinned global installation without enough safeguards.

Install only if you are comfortable giving an agent broad browser-control capability. Avoid saving credentials or auth state unless necessary, protect any saved state files like passwords, do not attach it to your everyday Chrome profile, and review the global installer or use a pinned, isolated installation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/setup.sh:14
Finding

Unpinned Global Package Installation and Dynamic Component Retrieval

Content
View full analysis

Vulnerability Details

File Location: scripts/setup.sh:14, 21-23
Vulnerability Type: Unpinned third-party dependency and dynamically retrieved components
Risk Level: Medium

Vulnerable Code

bash
npm install -g agent-browser
bash
if [[ "$(uname)" == "Linux" ]]; then
    agent-browser install --with-deps 2>/dev/null || agent-browser install
else
    agent-browser install
fi

Technical Analysis

The setup script globally installs agent-browser without specifying an exact version or validating package integrity. It then immediately executes the newly installed tool to retrieve Chromium and, on Linux, potentially install operating-system dependencies.

Because neither the npm package version nor the retrieved browser components are pinned and verified, the effective installation behavior can change after this Skill has been reviewed. A compromised package release, maintainer account, transitive dependency, registry response, or browser download source could introduce arbitrary code into the installation process.

The global installation also modifies the host environment rather than isolating the dependency to the project. If setup is executed with elevated privileges, npm lifecycle scripts and dependency-installation operations may inherit those privileges.

Attack Path

  1. An attacker compromises the upstream agent-browser package, one of its transitive dependencies, its maintainer account, or a component-download source.
  2. The attacker publishes or serves a malicious version under the expected package or component identity.
  3. A user runs scripts/setup.sh.
  4. npm install -g agent-browser resolves and installs the uncontrolled current release, including any applicable npm lifecycle scripts.
  5. The script executes the newly installed agent-browser binary through agent-browser install.
  6. Malicious installation code executes with the permissions of the invoking user.
  7. If the setup process is run with adminis ...[truncated 725 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin agent-browser to an exact, reviewed version rather than resolving the latest release:

    bash
    npm install --global --ignore-scripts agent-browser@X.Y.Z

    Confirm first whether disabling lifecycle scripts is compatible with the package.

  2. Prefer a project-local dependency managed by a committed lockfile instead of a global installation:

    bash
    npm install --save-exact agent-browser@X.Y.Z

  3. Use deterministic installation mechanisms such as npm ci with a reviewed and committed lockfile.

  4. Verify package provenance and integrity through trusted registry configuration, lockfile integrity hashes, npm provenance where available, and organizational artifact signing or mirroring.

  5. Pin the Chromium revision and verify its checksum or signature before installation. Document all expected package registries and component-download domains.

  6. Avoid running the setup script as root. If operating-system packages are required, separate that step, explicitly list the packages, and require deliberate administrator approval.

  7. Execute browser tooling in a sandboxed container or similarly restricted environment with minimal filesystem, credential, and network access.

  8. Add an explicit version check so an already installed but unexpected agent-browser version is rejected rather than trusted solely because the command exists.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/commands.md (reported line 122)May include surrounding context.

bash
agent-browser --headed open <url>     # Visual browser
agent-browser highlight @e1           # Highlight element
agent-browser record start demo.webm  # Record session
agent-browser eval "document.title"   # Run JavaScript

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger description is excessively broad and includes catch-all language like 'any task requiring programmatic web interaction,' which can cause the skill to activate in situations beyond the user's intent. In an agent context, overbroad activation increases the chance of unnecessary browser use, navigation to untrusted sites, and unintended execution of risky web actions such as form submission, downloads, or login flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The examples normalize filling credentials and saving authenticated browser state to a file without warning about secret handling, session token sensitivity, or reuse risk. In a browser automation skill, persisted auth state can grant ongoing access equivalent to a logged-in session, so careless handling may expose accounts or enable unauthorized access if the file is leaked or reused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation advertises built-in credential storage and replay via an auth vault, which extends the tool beyond ordinary page interaction into secret handling. In an AI-agent context, this is risky because stored credentials can be reused for unintended logins or abused if the agent is manipulated, and the docs do not frame these commands with strong trust-boundary warnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The example shows passing and storing login credentials without any caution about secret exposure, shell history risks, persistence, or consent. Even though --password-stdin is better than a command-line password, the docs still normalize credential capture and replay in an agent-facing tool without sufficient safety guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Saving and restoring browser state can capture cookies and localStorage containing session tokens or other sensitive identifiers, yet the docs omit any warning about that sensitivity. In an agent context, persisted state can silently transfer authenticated access across runs or users, increasing the chance of session leakage or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The recording, Chrome-connect, and local file access examples can expose sensitive on-screen data, existing browser context, and filesystem contents, but the docs present them without privacy or system-data warnings. For an AI agent, these features increase the chance of capturing unrelated secrets or local data beyond the intended webpage task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The eval command enables arbitrary JavaScript execution in the browser context, which goes beyond the stated purpose of routine browser automation and data extraction. In an agent setting, this can be leveraged to access page data, manipulate application state, or execute unintended actions with the user's authenticated session.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Connecting to an existing Chrome instance via auto-discovery or CDP can grant access to tabs, cookies, and authenticated state outside the tool's own isolated session. For an AI agent, this materially expands the trust boundary and may expose unrelated browsing context, making accidental or adversarial cross-session access possible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The description advertises downloading files and producing local artifacts without a user-facing warning about filesystem effects, storage location, or the risk of writing untrusted content locally. While not inherently unsafe, this can mislead an agent into performing side-effecting file operations without adequate disclosure or safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The setup script performs global system modifications by running npm install -g agent-browser and installing Chromium and possibly OS dependencies without an explicit warning or confirmation step. While this is common in installer scripts and appears intended to simplify setup rather than cause harm, it can surprise users, alter the host environment, and trigger privileged package changes in ways that are risky in agent-driven or unattended contexts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.