Agb

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:14 AM UTC
• Version: 1.0.0

Overview

The skill does provide browser automation as advertised, but it grants broad authenticated-browser control and session persistence without enough safeguards or scoping guidance.

Install only if you are comfortable letting the agent control a browser, interact with live websites, and potentially handle authenticated sessions. Avoid using it with banking, personal accounts, production admin consoles, or sensitive internal apps unless you explicitly direct each action. Treat saved state files, screenshots, PDFs, page text, traces, and recordings as secrets; store them outside repositories, restrict permissions, and delete them when done. Use named sessions and agent-browser close for cleanup, and avoid untrusted proxies, extensions, CDP attachment, and eval on sensitive pages.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:15

Finding

Overbroad Chromium Process Termination

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15
Vulnerability Type: Improper process scoping and violation of least privilege
Risk Level: Medium

Vulnerable Code

bash

pkill -f chromium

Technical Analysis

The documented cleanup command uses pkill -f, which matches the supplied pattern against the complete command line of every process visible to the invoking account. It is not restricted to Chromium processes started by this Skill, a particular browser session, or a recorded process ID.

Consequently, running the prescribed cleanup can terminate unrelated Chromium instances and any other process whose command line happens to contain chromium. The command exercises broader process-control authority than is necessary to clean up the Skill's own browser session.

Attack Path

1. Another user task, automation job, or service starts Chromium under the same operating-system account.
2. The Skill performs a browser-automation task.
3. The operator or agent follows the cleanup instruction and executes pkill -f chromium.
4. The pattern matches both the Skill's browser and unrelated Chromium processes.
5. All matching processes accessible to the caller are terminated without checking ownership by the current Skill invocation.

No additional privilege escalation is demonstrated; exploitation is limited to processes the invoking account already has permission to signal.

Impact Assessment

The command can cause denial of service, interruption of unrelated tests or automation, loss of unsaved browser data, and termination of active browsing sessions. The affected scope consists of all matching processes that the executing account is authorized to terminate, rather than only the process created for the current task.

Remediation

View remediation

Remediation Suggestions

• Replace global process matching with session-aware cleanup:

  bash

  agent-browser --session "$SESSION_NAME" close
  

• Assign a unique session name to every independent task and close only that session.

• If process-level cleanup is unavoidable, record the PID of the process created by the current invocation, validate that it still belongs to the expected executable and user, and signal only that PID.

• Use a cleanup trap in executable workflows so targeted cleanup occurs even when a command fails.

• Do not use pkill -f for routine browser cleanup.

T09 · Insecure Skill Coding Practices

Warning

• Location: templates/authenticated-session.sh:15

Finding

Authentication State May Be Persisted Without Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Location: templates/authenticated-session.sh:15,89
Related Locations: SKILL.md:289-301, references/authentication.md:27-42, references/session-management.md:29-44
Vulnerability Type: Insecure storage of reusable authentication material
Risk Level: Medium

Vulnerable Code

bash

STATE_FILE="${2:-./auth-state.json}"

The login-flow template instructs the user to enable the following state-saving operation:

bash

agent-browser state save "$STATE_FILE"

Technical Analysis

Browser state files can contain cookies, local storage, session storage, and reusable authentication tokens. The template uses a predictable file in the current directory by default and does not establish a restrictive umask, create a private storage directory, enforce mode 0600, or validate ownership before subsequently loading the file.

The reference documentation correctly warns that state files contain authentication tokens and should not be committed. That warning does not, however, enforce confidentiality against other local processes, shared workspaces, backups, artifact collection, or accidental repository inclusion.

The state-saving line is part of a template login section that users are instructed to uncomment and customize. Once enabled as documented, the resulting file permissions depend on the caller's inherited environment and the behavior of agent-browser.

Attack Path

1. An operator enables the documented login-flow section and authenticates to a target application.
2. The browser state is saved to the default ./auth-state.json or another caller-selected path.
3. The file is created under inherited directory permissions and process umask, without an explicit confidentiality check by the template.
4. A local user, shared-workspace process, backup system, CI artifact collector, or repository operation obtains the state file where surrounding permissi ...[truncated 853 chars]

Remediation

View remediation

Remediation Suggestions

• Set a restrictive file-creation mask before creating authentication state:

  bash

  umask 077
  

• Store state outside the repository in a private runtime directory:

  bash

  STATE_DIR="${XDG_RUNTIME_DIR:-$HOME/.local/state}/agent-browser"
  mkdir -p "$STATE_DIR"
  chmod 700 "$STATE_DIR"
  STATE_FILE="${2:-$STATE_DIR/auth-state.json}"
  

• After saving, explicitly enforce and verify permissions:

  bash

  agent-browser state save "$STATE_FILE"
  chmod 600 "$STATE_FILE"
  

• Before loading, reject symbolic links, verify that the file is owned by the current user, and reject files readable or writable by group or other users.

• Add applicable state-file patterns to .gitignore, while recognizing that .gitignore is not an access-control mechanism.

• Delete the state file after use unless persistence is explicitly required.

• Prefer short-lived sessions and server-side token expiration or revocation.

• Ensure CI systems do not publish state files as build artifacts or retain them in shared workspaces.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (20)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/authentication.md (reported line 179)May include surrounding context.

3. Clean up after automation

   bash

   agent-browser cookies clear
   rm -f ./auth-state.json
   

4. Use short-lived sessions for CI/CD

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/session-management.md (reported line 173)May include surrounding context.

echo "*.auth-state.json" >> .gitignore

Delete after use

rm /tmp/auth-state.json

text

### 4. Timeout Long Sessions

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description advertises form filling, screenshots, and data extraction but does not warn that these actions can capture sensitive personal, financial, or session data and can perform side-effecting actions on live websites. In an autonomous agent context, omission of privacy and consent boundaries increases the chance of misuse or accidental overreach.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents and exposes capabilities well beyond ordinary browser testing and form automation, including arbitrary JavaScript execution, CDP connection, proxy use, extension loading, and network interception. In an agent setting, these features materially expand the attack surface and enable stealthy data access, traffic manipulation, or attachment to an existing browser session without clear scope limitation or safety guidance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

agent-browser eval "document.title" indicates arbitrary JavaScript execution in the active page context. That allows DOM scraping, token extraction from page state, manipulation of page behavior, and bypass of safer high-level interaction patterns, which is risky for a browser automation skill unless tightly justified and constrained.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Allowing arbitrary browser extensions introduces execution of untrusted code inside the browser environment, potentially with broad access to page content, cookies, requests, and user activity. This is outside the stated browser-automation scope and creates a strong avenue for persistence, surveillance, or data exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples normalize saving and reloading authenticated browser state without warning that such files may contain reusable session material equivalent to account access. If mishandled, these artifacts can enable account takeover, lateral movement across sessions, or unauthorized reuse of authenticated context.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Persisting and later reloading browser state creates durable authenticated context that may outlive the original task and bypass normal login controls. In an agent environment, this increases the risk of session theft, unintended cross-task access, and misuse of stored authentication artifacts.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

agent-browser wait --url "**/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code launches an external binary via child_process.spawn to perform browser actions, but there is no confirmation prompt, visible logging, or user-facing comment/docstring disclosing that the skill executes a subprocess. Because this is a code file and shell/subprocess execution is explicitly in scope for missing-warning review, the operation should be disclosed somewhere visible to users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The screenshot function can write an image to a user-supplied path, which is a file write operation covered by this rule. The code provides no confirmation, visible log, or explanatory comment/docstring warning users that invoking this action may create or overwrite screenshot files.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes a direct wrapper around agb eval that accepts arbitrary JavaScript and forwards it into the browser context with no restriction, validation, or policy guard. For a browser-automation skill, this substantially broadens capability from navigation/testing into arbitrary in-page code execution, enabling data extraction, DOM tampering, token theft from accessible page context, and unsafe actions on authenticated sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example saves authenticated browser state to a local file immediately after login without an inline warning that the file may contain session cookies or tokens equivalent to active credentials. In a browser automation skill, users are likely to copy-paste these snippets directly, so omitting proximity guidance increases the chance that sensitive state is stored insecurely, shared, or committed to source control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The OAuth/SSO example persists authenticated state after a third-party login flow without warning that the saved file may contain reusable Google or federated session artifacts. Because this skill is specifically for browser automation, persisting SSO state is especially risky: copied examples can silently normalize storing high-value third-party sessions on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation shows authenticated proxy credentials embedded directly in environment variables and proxy URLs without warning that such secrets may be exposed through shell history, process inspection, logs, crash reports, or copied scripts. In a browser automation skill, proxy settings affect all outbound traffic, so compromised proxy credentials or unsafe handling can expose browsing activity and enable unauthorized proxy use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The rotating-proxy scraping example encourages routing automated browsing and extracted page content through third-party proxy infrastructure without warning that proxies can observe destinations, metadata, and in some cases page contents or credentials. In this skill context, the tool is explicitly used for web navigation and data extraction, which makes undisclosed proxy trust and data-handling risks more relevant because users may process sensitive pages or harvested data through untrusted intermediaries.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 55% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/session-management.md (reported line 43)May include surrounding context.

Load Session State

bash

# Restore saved state
agent-browser state load /path/to/auth-state.json

# Continue with authenticated session

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation demonstrates recording a login workflow and entering credentials while saving a browser session to video, but it provides no warning about capturing secrets, session data, or other sensitive page content. In a browser automation skill, this is materially risky because users may copy the example into real environments, producing recordings that expose passwords, tokens, personal data, or internal application state in artifacts and CI storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The commented example demonstrates loading an auth-state.json file, which likely contains sensitive authenticated session state. Although it is commented out, there is no nearby warning or disclosure explaining the sensitivity of this credential-like data or the risks of using it during capture workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

A prominent instructions section is written in Chinese while the rest of the document is in English, and the file does not state that the skill is intentionally Chinese-only or offer a language/locale option. This can create an implicit locale constraint without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:11

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: index.js:117