Security audit

Agent Browser Clawdbot 20260401

Security checks for vulnerabilities and agentic risk

Overview

This browser-automation skill is coherent, but it needs review because it encourages saving and manipulating login browser state and recommends a broad unpinned global install.

Install only in an environment you trust, preferably isolated. Treat saved auth JSON, cookies, and localStorage output like credentials: do not commit or share them, keep them scoped to test accounts when possible, and delete them when no longer needed. Review the npm package/version before global installation and avoid running dependency setup with elevated privileges unless you understand the host changes.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:195
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
``` 2. Verify the package name, publisher, registry origin, release provenance, and expected integrity before installation. 3. Prefer a project-local dependency with a committed lockfile over global installation. 4. Use npm lockfile integrity metadata and automated dependency monitoring to detect unexpected package changes. 5. Disable lifecycle scripts during installation when they are not required: ```bash npm install --ignore-scripts agent-browser@ ``` If installation scripts are required, review them before enabling them. 6. Run browser and system-dependency installation inside a sandboxed container or disposable environment with minimal filesystem and network access. 7. Do not run npm installation as `root` or through `sudo`. Separate any required operating-system dependency installation into a reviewed, explicitly versioned administrative procedure. 8. Pin and verify downloaded browser artifacts where supported, including expected versions and checksums. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly recommends saving and loading browser auth state, which typically contains session cookies and web storage artifacts that can grant authenticated access if reused. In an agent context, this is risky because the documentation encourages persistence of sensitive state without warning about secure storage, scope limitation, expiration, or redaction, increasing the chance of credential/session leakage or unintended account access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The documentation exposes commands to read and modify cookies and localStorage without any warning that these values may contain authentication material, personal data, or state-changing inputs. In a headless automation skill used by agents, normalizing direct access to browser state can lead to accidental exfiltration, unsafe mutation of application state, or misuse of privileged session data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.