ClawHub
Back to skill

Security audit

Cxz9909 Agentbrowser

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent browser automation skill with expected sensitive capabilities, but users should treat saved browser state and install sources carefully.

Install from a version or commit you trust, preferably without administrator privileges. Treat saved browser state files, cookies, storage dumps, screenshots, PDFs, traces, and recordings as sensitive because they may contain account access or private page data. Keep them outside project repositories, restrict file permissions, and delete them when no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Unpinned Third-Party Dependencies and Mutable Installation Sources

Content
View full analysis
Remediation
View remediation
``` 2. Pin source installations to a reviewed immutable commit: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout --detach ``` 3. Publish the expected package integrity hash and source commit alongside the installation instructions. 4. Verify npm provenance or signed release artifacts before installation. 5. Use and enforce a committed lockfile for source builds, including frozen-lockfile installation mode. 6. Review package lifecycle and build scripts before executing them. 7. Remove the recommendation to install `@latest`; upgrades should be explicit and reviewed. 8. Document that installation should occur without administrative privileges and preferably inside an isolated development environment or container. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:235
Finding

Authenticated Browser State Saved to an Unprotected Plaintext File

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly supports HTTP basic auth and saving/loading browser session state, which can include cookies, tokens, and other authenticated context, but it does not warn users that these artifacts are sensitive secrets. In an agent setting, this increases the risk of credential leakage, unsafe reuse, or accidental exfiltration through logs, saved files, or follow-on tasks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

Saving and loading browser session state enables persistence of authenticated sessions across runs, which can preserve cookies, tokens, and other access material. Without warnings or handling guidance, users may store reusable auth artifacts insecurely and unintentionally grant future access to whoever can read the file.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The authentication example normalizes reusing a saved auth.json file to restore access to an authenticated application session, but it does not explain the security sensitivity of that file. In this context, the example makes the risk more dangerous because it encourages routine persistence and reuse of portable authentication state.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The skill documents commands that write screenshots and PDFs to local files, but it does not warn that these actions modify the filesystem and may persist sensitive page contents. In agent workflows, silent file creation can leave behind confidential data or overwrite expected outputs if paths are reused carelessly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.