Taizi Agent Browser

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:29 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is coherent, but it needs review because it documents unpinned global installs and reusable authenticated browser state without enough safety guidance.

Install only in a least-privileged or isolated environment, pin and verify the agent-browser package/source where possible, and treat saved auth state, screenshots, PDFs, videos, traces, cookies, localStorage, and uploaded files as sensitive. Do not save auth.json in shared repositories or workspaces; restrict its permissions and delete it when the task is complete.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18
• Finding: Unpinned Third-Party Browser Automation Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 18-20 and 26-29 **Vulnerability Type**: Unpinned third-party package and source installation **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build ``` ### Technical Analysis The installation instructions retrieve and execute third-party software without pinning a reviewed npm package version or Git commit. No checksum, package integrity value, trusted release signature, or equivalent verification is required. The npm workflow installs the package globally and may execute package lifecycle scripts. The source workflow builds the current repository state and resolves transitive packages through `pnpm install`. Consequently, the effective code installed by these commands can change after the Skill has been reviewed. This creates a supply-chain exposure: compromise of the npm package, upstream repository, maintainer account, release process, or transitive dependency could cause attacker-controlled code to execute during installation or later CLI use. The `--with-deps` option may additionally make system-level dependency changes, depending on upstream behavior and the privileges under which it is invoked. ### Attack Path 1. An attacker compromises the upstream npm package, source repository, maintainer credentials, release pipeline, or a transitive dependency. 2. The attacker publishes a malicious package release or modifies the repository branch fetched by the documented commands. 3. A user or Agent follows the unpinned installation instructions. 4. npm, Git, or pnpm retrieves the attacker-controlled version because no immutable version or commit is specified. 5. Malicious lifecycle scripts, build steps, installation logic, or the resulting executable run in th ...[truncated 839 chars]
• Remediation: ## Remediation Suggestions 1. Pin `agent-browser` to a specifically reviewed version rather than resolving the current release: ```bash npm install -g agent-browser@<reviewed-version> ``` 2. Pin source installations to a reviewed commit hash or signed release tag: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout <reviewed-commit-hash> ``` 3. Publish and verify package integrity hashes, release checksums, or cryptographic signatures before installation. 4. Use a committed lockfile with frozen dependency resolution for source builds. 5. Recommend installation in an isolated, least-privileged environment rather than directly into a privileged global environment. 6. Document the system changes and privilege requirements associated with `agent-browser install --with-deps`. 7. Establish a controlled update process in which new versions and commits are reviewed before changing the pinned reference.

T08 · Insecure Dependencies

Warning

• Location: CONTRIBUTING.md:18
• Finding: Explicit Installation of Mutable Latest Package Release## Vulnerability Details **File Location**: `CONTRIBUTING.md`, lines 18-21 **Vulnerability Type**: Mutable latest-version dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g agent-browser@latest ``` ### Technical Analysis The contribution guide explicitly instructs users to install the `latest` npm release. The `latest` distribution tag is mutable and can be reassigned to a different package version after this project has been audited. The command therefore does not identify an immutable, previously reviewed artifact. A global npm installation may execute dependency lifecycle scripts and places the resulting executable in the user's global npm environment. If a future release, package maintainer account, publishing pipeline, or dependency is compromised, following this troubleshooting instruction could execute attacker-controlled code. ### Attack Path 1. An attacker gains control over the npm package publication process or a dependency included in a future release. 2. A malicious release is assigned the npm `latest` distribution tag. 3. A contributor follows the documented pre-issue troubleshooting procedure. 4. npm resolves `agent-browser@latest` to the attacker-controlled release. 5. Malicious installation scripts or package code execute with the privileges of the contributor's npm installation process. 6. The globally installed command may continue executing malicious behavior during subsequent browser automation sessions. ### Impact Assessment Exploitation could result in arbitrary code execution as the installing user, compromise of files and credentials accessible to that user, or replacement of the globally invoked `agent-browser` executable. The impact could become system-wide if the command is executed through an elevated or privileged npm configuration. This is a supply-chain hardening issue; the audited files do not establish that the current package release contai ...[truncated 18 chars]
• Remediation: ## Remediation Suggestions Replace `@latest` with an explicitly reviewed version and keep that version synchronized with the Skill's tested compatibility requirements: ```bash npm install -g agent-browser@<reviewed-version> ``` Additionally: 1. Document the expected package checksum or integrity metadata. 2. Test and approve dependency updates before changing the documented version. 3. Advise contributors not to run global package installations with administrative privileges. 4. Prefer an isolated development environment or project-local installation where practical. 5. Add a documented procedure for verifying the package publisher, release provenance, and signature before installation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documented commands allow uploading local files and saving screenshots/PDFs/videos to disk, but the skill does not warn that these operations can transmit local data to remote websites or create sensitive local artifacts. In an autonomous agent workflow, that omission can lead to accidental exfiltration of local files or persistence of sensitive page contents on disk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly documents `set credentials user pass` and saving/loading browser state to `auth.json` without any warning that credentials, cookies, tokens, or other authenticated session artifacts may be stored locally or exposed to other processes/users. In an agent context, this increases the chance that secrets are persisted insecurely, reused across tasks, or unintentionally exfiltrated through logs, artifacts, or shared workspaces.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 94% confidence
• Finding: The `state save auth.json` / `state load auth.json` feature persists authenticated browser state, likely including cookies and session tokens, yet the skill provides no warning about securing or limiting access to these files. If such files are read by other users, tools, or later tasks, an attacker could hijack authenticated sessions without needing the original credentials.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 95% confidence
• Finding: The example workflow encourages reusing `auth.json` across later sessions, normalizing long-lived session persistence without discussing token lifetime, theft risk, or cleanup. In the context of an agent skill designed for automation, this increases the likelihood of unattended session reuse and session-token exposure across tasks or environments.

Static analysis

No suspicious patterns detected.