T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:44- Finding
Unverified Remote Installer Is Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Browser - 浏览器自动化
Security checks for vulnerabilities and agentic risk
Overview
This browser automation skill is mostly purpose-aligned, but it gives agents sensitive browser-session capabilities and unsafe installation paths without enough scoping or warnings.
Review before installing. Prefer a pinned, verified agent-browser release instead of global latest installs or curl-to-shell setup. Treat saved state files, cookies, screenshots, PDFs, videos, traces, and command logs as sensitive, especially on authenticated pages, and delete or protect them after use.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:20- Finding
Unpinned Global npm Package Installation Exposes Users to Supply-Chain Changes
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:47- Finding
Conflicting Upstream Repository Instructions Create Supply-Chain Ambiguity
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (10)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Adding New Commands to the Skill Update SKILL.md when the upstream CLI adds new commands. - Keep the Installation section - Add new commands in the correct category - Include usage examples
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The '| sh' pattern is a classic unsafe command-execution chain because it immediately runs remote content in the user's shell. In skill context, users may copy-paste setup commands without scrutiny, so this materially increases the risk of arbitrary code execution if the remote source is ever compromised or replaced.
- Content
bash # 安装 Rust (如果还没有) curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh # 克隆并编译 git clone https://github.com/openclaw/agent-browser.git
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documentation and all usage examples are presented in Chinese, including the example prompts a user is expected to use in OpenClaw. There is no indication that another language is supported, no opt-in for locale choice, and no justification that the skill is intended only for a Chinese-speaking region or compliance context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file documents capabilities that can capture page contents and execute JavaScript, both of which may affect user data, privacy, or the integrity of a browsing session. The description and examples present these actions as routine usage but do not include any caution about handling sensitive pages, credentials, or the effects of running page scripts.
- Content
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill encourages writing screenshots, PDFs, videos, traces, and other artifacts to files, but does not consolidate warnings that these artifacts can capture sensitive page contents, PII, secrets, or authenticated workflows. In browser automation, such files often contain far more data than intended and can remain on disk or be shared inadvertently.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly documents HTTP basic auth credentials and saving/loading browser session state, but provides no warning that these values may contain secrets such as passwords, cookies, tokens, or authenticated session material. In an agent setting, this increases the risk that secrets are persisted to disk, exposed in logs, or reused across tasks without user awareness.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The documented ability to save and later load browser session state creates a persistence mechanism for authenticated cookies, tokens, and local storage. Without warnings or controls, this can enable account/session reuse beyond the original task, cross-task contamination, or leakage of portable authentication artifacts.
- Content
bash agent-browser state save auth.json # Save session state agent-browser state load auth.json # Load saved stateExample: Form submission
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The authentication example normalizes saving login state to auth.json and reloading it in future sessions, which effectively teaches persistence of reusable authenticated access. In an agent environment, this is dangerous because state files can be copied, replayed, or accidentally used by another workflow to access protected resources.
- Content
agent-browser wait --url "/dashboard" agent-browser state save auth.json
Later sessions: load saved state
agent-browser state load auth.json agent-browser open https://app.example.com/dashboard
text
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
The README instructs users to fetch and execute a remote installation script directly via curl piped into sh. This is dangerous because it executes network-delivered code without an opportunity for inspection, making users vulnerable to upstream compromise, MITM via trusted endpoint compromise, or malicious script changes.
- Content
bash # 安装 Rust (如果还没有) curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh # 克隆并编译 git clone https://github.com/openclaw/agent-browser.git