ClawHub
Back to skill

Security audit

Taizi Agent Browser

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is coherent, but it needs review because it documents unpinned global installs and reusable authenticated browser state without enough safety guidance.

Install only in a least-privileged or isolated environment, pin and verify the agent-browser package/source where possible, and treat saved auth state, screenshots, PDFs, videos, traces, cookies, localStorage, and uploaded files as sensitive. Do not save auth.json in shared repositories or workspaces; restrict its permissions and delete it when the task is complete.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Unpinned Third-Party Browser Automation Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-20 and 26-29
Vulnerability Type: Unpinned third-party package and source installation
Risk Level: Medium

Vulnerable Code

bash
npm install -g agent-browser
agent-browser install
agent-browser install --with-deps
bash
git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
pnpm install
pnpm build

Technical Analysis

The installation instructions retrieve and execute third-party software without pinning a reviewed npm package version or Git commit. No checksum, package integrity value, trusted release signature, or equivalent verification is required.

The npm workflow installs the package globally and may execute package lifecycle scripts. The source workflow builds the current repository state and resolves transitive packages through pnpm install. Consequently, the effective code installed by these commands can change after the Skill has been reviewed.

This creates a supply-chain exposure: compromise of the npm package, upstream repository, maintainer account, release process, or transitive dependency could cause attacker-controlled code to execute during installation or later CLI use. The --with-deps option may additionally make system-level dependency changes, depending on upstream behavior and the privileges under which it is invoked.

Attack Path

  1. An attacker compromises the upstream npm package, source repository, maintainer credentials, release pipeline, or a transitive dependency.
  2. The attacker publishes a malicious package release or modifies the repository branch fetched by the documented commands.
  3. A user or Agent follows the unpinned installation instructions.
  4. npm, Git, or pnpm retrieves the attacker-controlled version because no immutable version or commit is specified.
  5. Malicious lifecycle scripts, build steps, installation logic, or the resulting executable run in th ...[truncated 839 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin agent-browser to a specifically reviewed version rather than resolving the current release:
    bash
    npm install -g agent-browser@<reviewed-version>
  2. Pin source installations to a reviewed commit hash or signed release tag:
    bash
    git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
git checkout <reviewed-commit-hash>
  3. Publish and verify package integrity hashes, release checksums, or cryptographic signatures before installation.
  4. Use a committed lockfile with frozen dependency resolution for source builds.
  5. Recommend installation in an isolated, least-privileged environment rather than directly into a privileged global environment.
  6. Document the system changes and privilege requirements associated with agent-browser install --with-deps.
  7. Establish a controlled update process in which new versions and commits are reviewed before changing the pinned reference.

T08 · Insecure Dependencies

Warning
Location
CONTRIBUTING.md:18
Finding

Explicit Installation of Mutable Latest Package Release

Content
View full analysis

Vulnerability Details

File Location: CONTRIBUTING.md, lines 18-21
Vulnerability Type: Mutable latest-version dependency installation
Risk Level: Medium

Vulnerable Code

bash
npm install -g agent-browser@latest

Technical Analysis

The contribution guide explicitly instructs users to install the latest npm release. The latest distribution tag is mutable and can be reassigned to a different package version after this project has been audited. The command therefore does not identify an immutable, previously reviewed artifact.

A global npm installation may execute dependency lifecycle scripts and places the resulting executable in the user's global npm environment. If a future release, package maintainer account, publishing pipeline, or dependency is compromised, following this troubleshooting instruction could execute attacker-controlled code.

Attack Path

  1. An attacker gains control over the npm package publication process or a dependency included in a future release.
  2. A malicious release is assigned the npm latest distribution tag.
  3. A contributor follows the documented pre-issue troubleshooting procedure.
  4. npm resolves agent-browser@latest to the attacker-controlled release.
  5. Malicious installation scripts or package code execute with the privileges of the contributor's npm installation process.
  6. The globally installed command may continue executing malicious behavior during subsequent browser automation sessions.

Impact Assessment

Exploitation could result in arbitrary code execution as the installing user, compromise of files and credentials accessible to that user, or replacement of the globally invoked agent-browser executable. The impact could become system-wide if the command is executed through an elevated or privileged npm configuration.

This is a supply-chain hardening issue; the audited files do not establish that the current package release contai ...[truncated 18 chars]

Remediation
View remediation

Remediation Suggestions

Replace @latest with an explicitly reviewed version and keep that version synchronized with the Skill's tested compatibility requirements:

bash
npm install -g agent-browser@<reviewed-version>

Additionally:

  1. Document the expected package checksum or integrity metadata.
  2. Test and approve dependency updates before changing the documented version.
  3. Advise contributors not to run global package installations with administrative privileges.
  4. Prefer an isolated development environment or project-local installation where practical.
  5. Add a documented procedure for verifying the package publisher, release provenance, and signature before installation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documented commands allow uploading local files and saving screenshots/PDFs/videos to disk, but the skill does not warn that these operations can transmit local data to remote websites or create sensitive local artifacts. In an autonomous agent workflow, that omission can lead to accidental exfiltration of local files or persistence of sensitive page contents on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly documents set credentials user pass and saving/loading browser state to auth.json without any warning that credentials, cookies, tokens, or other authenticated session artifacts may be stored locally or exposed to other processes/users. In an agent context, this increases the chance that secrets are persisted insecurely, reused across tasks, or unintentionally exfiltrated through logs, artifacts, or shared workspaces.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The state save auth.json / state load auth.json feature persists authenticated browser state, likely including cookies and session tokens, yet the skill provides no warning about securing or limiting access to these files. If such files are read by other users, tools, or later tasks, an attacker could hijack authenticated sessions without needing the original credentials.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The example workflow encourages reusing auth.json across later sessions, normalizing long-lived session persistence without discussing token lifetime, theft risk, or cleanup. In the context of an agent skill designed for automation, this increases the likelihood of unattended session reuse and session-token exposure across tasks or environments.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text