Agent Browser - 浏览器自动化

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:57 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is mostly purpose-aligned, but it gives agents sensitive browser-session capabilities and unsafe installation paths without enough scoping or warnings.

Review before installing. Prefer a pinned, verified agent-browser release instead of global latest installs or curl-to-shell setup. Treat saved state files, cookies, screenshots, PDFs, videos, traces, and command logs as sensitive, especially on authenticated pages, and delete or protect them after use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:44
• Finding: Unverified Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `README.md:44` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```bash curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh ``` ### Technical Analysis This command retrieves mutable content from an external URL and immediately executes it with the invoking user's shell. It does not provide an opportunity to inspect the installer and does not verify a pinned cryptographic checksum, signature, version, or immutable artifact. TLS protects the connection in transit but does not guarantee that the server, its infrastructure, or the installer content will remain trustworthy. If the remote endpoint or its delivery infrastructure is compromised, arbitrary commands can be supplied and executed. This behavior exceeds the minimum privileges necessary for the Skill itself. The package contains only documentation, the Skill declares Node.js and npm as its required binaries, and `SKILL.md` already provides an npm-based installation method. Installing Rust through an immediately executed remote script is therefore not intrinsically required for normal use of the declared Skill. ### Attack Path 1. A user follows the source-build instructions in `README.md`. 2. The user executes the documented `curl | sh` pipeline. 3. The command downloads the current response from `https://sh.rustup.rs`. 4. The response is passed directly to the local shell without inspection or artifact verification. 5. If the remote service, hosting infrastructure, DNS resolution, certificate authority chain, or distribution process has been compromised, the substituted script executes arbitrary shell commands. 6. Those commands run with all permissions available to the invoking user. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the installer. This may permit access to user files, credentials av ...[truncated 333 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the direct `curl | sh` installation instruction. - For normal Skill use, retain only the documented Node.js/npm installation path if Rust is not required. - If a Rust source build must be supported, direct users to the official Rust installation documentation rather than executing downloaded content automatically. - Prefer downloading a versioned installer artifact as a separate step. - Require verification using an officially published cryptographic signature or pinned checksum before execution. - Pin the expected installer or toolchain version and document the trusted source. - Instruct users to inspect the downloaded script before running it and to execute it without elevated privileges. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20
• Finding: Unpinned Global npm Package Installation Exposes Users to Supply-Chain Changes<![CDATA[ ## Vulnerability Details **File Locations**: `SKILL.md:20`, `CONTRIBUTING.md:25` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code From `SKILL.md`: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` From `CONTRIBUTING.md`: ```bash npm install -g agent-browser@latest ``` ### Technical Analysis The installation instructions retrieve a mutable npm package release. The unversioned package resolves according to the registry's current distribution tags, while `@latest` explicitly requests mutable latest-tag content. The project provides no exact reviewed version, lockfile, integrity value, signature, or provenance-verification procedure. npm packages can execute lifecycle scripts during installation. A compromised publisher account, registry entry, dependency release, or latest distribution tag could therefore cause attacker-controlled code to run during global installation. The subsequent `agent-browser install --with-deps` operation may also make broad environment changes, but the documentation does not explain what dependencies or privilege requirements it introduces. Global installation is broader than necessary for many workflows because it modifies user-wide tooling and makes the selected executable available across projects. ### Attack Path 1. An attacker compromises the npm publisher, package release process, registry metadata, or a transitive dependency. 2. The attacker publishes a malicious release or points the mutable `latest` tag to one. 3. A user follows either documented global installation command. 4. npm resolves and downloads the attacker-controlled package version. 5. Malicious lifecycle scripts can execute during installation, or malicious package logic executes when the CLI is invoked. 6. Because the package is installed globally, the affected executable remains available to other projects and future shell sessions. ### ...[truncated 651 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `agent-browser` to an exact reviewed version rather than using an unversioned package or `@latest`. - Prefer project-local installation over `npm install -g`. - Maintain and review a lockfile containing integrity metadata for the complete dependency graph. - Document how users can verify package provenance, publisher identity, and npm registry integrity information. - Review package lifecycle scripts and consider disabling them where they are not required. - Document exactly what `agent-browser install --with-deps` installs and whether it requires elevated privileges. - Publish a controlled upgrade process so new versions are reviewed before the documented pin is changed. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:47
• Finding: Conflicting Upstream Repository Instructions Create Supply-Chain Ambiguity<![CDATA[ ## Vulnerability Details **File Locations**: `README.md:47`, `SKILL.md:28`, `SKILL.md:326-328` **Vulnerability Type**: Ambiguous and unpinned source dependency **Risk Level**: Medium ### Vulnerable Code From `README.md`: ```bash git clone https://github.com/openclaw/agent-browser.git cd agent-browser cargo build --release ``` From `SKILL.md`: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build agent-browser install ``` The reporting section additionally distinguishes between the Skill repository and the CLI repository: ```markdown - Skill issues: Open an issue at https://github.com/TheSethRose/Agent-Browser-CLI - agent-browser CLI issues: Open an issue at https://github.com/vercel-labs/agent-browser ``` ### Technical Analysis The documentation presents different repositories in contexts that imply they may be the source for the same `agent-browser` implementation. It also references a third repository for Skill-related issues. No canonical-source declaration explains the relationship among these repositories. Both clone procedures retrieve the default branch without pinning a reviewed tag or commit. Consequently, the source compiled by a user can change after the Skill documentation is audited. The package contains no implementation or verification metadata that would allow users to establish which repository and revision correspond to the npm package. An attacker does not need to modify this documentation if a referenced repository, owner account, default branch, or repository-transfer process is compromised. The ambiguity also increases the likelihood that users will select and execute an unintended implementation. ### Attack Path 1. A user chooses one of the conflicting source installation procedures. 2. Git retrieves the current default branch from the selected repository. 3. The user runs `cargo build --release` or executes package installation and build commands such as `pnpm instal ...[truncated 926 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Identify one canonical upstream repository and use the same URL throughout all documentation. - Clearly explain the relationship between the Skill wrapper, CLI implementation, npm package, and any alternate repository. - Pin source-build instructions to a reviewed release tag and immutable commit hash. - Document how to verify signed Git tags or release signatures. - Provide checksums for distributed binaries and other release artifacts. - Document how the npm package version maps to the canonical source commit. - Remove obsolete or unrelated repository instructions to prevent users from building an unintended implementation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (10)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 安装 Rust (如果还没有)
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

# 克隆并编译
git clone https://github.com/openclaw/agent-browser.git

• Confidence: 97% confidence
• Finding: The '| sh' pattern is a classic unsafe command-execution chain because it immediately runs remote content in the user's shell. In skill context, users may copy-paste setup commands without scrutiny, so this materially increases the risk of arbitrary code execution if the remote source is ever compromised or replaced.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill documentation and all usage examples are presented in Chinese, including the example prompts a user is expected to use in OpenClaw. There is no indication that another language is supported, no opt-in for locale choice, and no justification that the skill is intended only for a Chinese-speaking region or compliance context.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This markdown file documents capabilities that can capture page contents and execute JavaScript, both of which may affect user data, privacy, or the integrity of a browsing session. The description and examples present these actions as routine usage but do not include any caution about handling sensitive pages, credentials, or the effects of running page scripts.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill encourages writing screenshots, PDFs, videos, traces, and other artifacts to files, but does not consolidate warnings that these artifacts can capture sensitive page contents, PII, secrets, or authenticated workflows. In browser automation, such files often contain far more data than intended and can remain on disk or be shared inadvertently.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly documents HTTP basic auth credentials and saving/loading browser session state, but provides no warning that these values may contain secrets such as passwords, cookies, tokens, or authenticated session material. In an agent setting, this increases the risk that secrets are persisted to disk, exposed in logs, or reused across tasks without user awareness.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 90% confidence
• Finding: The documented ability to save and later load browser session state creates a persistence mechanism for authenticated cookies, tokens, and local storage. Without warnings or controls, this can enable account/session reuse beyond the original task, cross-task contamination, or leakage of portable authentication artifacts.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 93% confidence
• Finding: The authentication example normalizes saving login state to auth.json and reloading it in future sessions, which effectively teaches persistence of reusable authenticated access. In an agent environment, this is dangerous because state files can be copied, replayed, or accidentally used by another workflow to access protected resources.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# 安装 Rust (如果还没有)
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

# 克隆并编译
git clone https://github.com/openclaw/agent-browser.git

• Confidence: 92% confidence
• Finding: The README instructs users to fetch and execute a remote installation script directly via curl piped into sh. This is dangerous because it executes network-delivered code without an opportunity for inspection, making users vulnerable to upstream compromise, MITM via trusted endpoint compromise, or malicious script changes.

Static analysis

No suspicious patterns detected.