Agent Browser Clawdbot Bak

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:16 AM UTC
• Version: 1.0.0

Overview

This is a browser automation helper with disclosed, purpose-aligned capabilities, but saved login state and cookies need careful handling.

Install only if you trust the agent-browser package source. Treat saved auth files, cookies, localStorage, and sessionStorage as credentials: keep them local, do not commit or share them, delete them when no longer needed, and avoid using high-privilege accounts unless the task requires it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:190

Finding

Unpinned Global Installation of a Third-Party Browser Automation Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 190-192
Vulnerability Type: Unpinned third-party dependency and unverified component installation
Risk Level: Medium

Vulnerable Code:

bash

npm install -g agent-browser
agent-browser install                     # Download Chromium
agent-browser install --with-deps         # Linux: + system deps

Technical Analysis

The documented installation procedure globally installs the latest available version of the agent-browser npm package without an exact version, lockfile, integrity hash, or provenance verification. The newly installed executable is then invoked to download Chromium and, optionally, install system dependencies.

Because package resolution is not pinned, the effective code installed can change after the Skill has been reviewed. A compromised maintainer account, malicious package release, registry compromise, or compromised downstream artifact could cause arbitrary package or lifecycle code to execute during installation. Global installation increases the affected scope by exposing the package across the user's environment.

The subsequent install and install --with-deps commands introduce additional supply-chain exposure because they retrieve and install external components without documented checksum or signature validation.

Attack Path

1. An attacker compromises the npm package, its publisher account, its release pipeline, or a component downloaded by the package.
2. The attacker publishes or substitutes a malicious release while preserving the expected package name.
3. A user follows SKILL.md and runs npm install -g agent-browser without an exact version constraint.
4. The package manager resolves the attacker-controlled release and executes any applicable installation or lifecycle logic with the installing user's permissions.
5. The user invokes the installed executable to download Chromium or system dependencies ...[truncated 962 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin agent-browser to a reviewed exact version rather than implicitly installing the latest release.
2. Prefer a project-local dependency recorded in a lockfile over a global installation.
3. Verify npm package provenance, publisher identity, integrity metadata, and release signatures before installation.
4. Review package lifecycle scripts and use installation controls that disable scripts where they are not required.
5. Pin and verify downloaded Chromium artifacts using trusted checksums or signatures.
6. Document the exact external components and versions installed by install --with-deps.
7. Perform installation under a dedicated, least-privileged account or isolated environment, and avoid administrative privileges unless explicitly required.
8. Periodically audit pinned versions for known vulnerabilities and update them through a controlled review process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly recommends saving and reloading browser auth state, which typically includes cookies and other session artifacts that can grant authenticated access. Without any warning about secure storage, scoping, expiration, or prohibition on sharing these files, users or agents may persist sensitive session data insecurely and unintentionally reuse privileged sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill documents commands for reading and modifying cookies and browser storage but omits any notice that these values may contain tokens, PII, or session identifiers. In an agent context, exposing such capabilities without guardrails increases the risk of credential leakage, privacy violations, or unsafe manipulation of authenticated state.

Content

No source excerpt is available for this finding.