ClawHub
Back to skill

Security audit

tekin

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent browser automation skill, but it asks users to install mutable global tooling and normalizes saving reusable login state without enough safety guidance.

Review before installing. Use an isolated account or sandbox, pin and verify the agent-browser version or commit, avoid production credentials when possible, treat saved state files, traces, screenshots, videos, cookies, and storage dumps as secrets, and delete auth state when finished.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party CLI and Browser Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–24
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
npm install -g agent-browser
agent-browser install
agent-browser install --with-deps
bash
git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
pnpm install
pnpm build
agent-browser install

Technical Analysis

The installation instructions retrieve and execute mutable third-party content without pinning the npm package to a reviewed version or the Git repository to a specific commit. The source installation also resolves transitive dependencies through pnpm install, but this project does not provide a lockfile or integrity information for that process.

Consequently, the effective code installed by these commands can change after the Skill has been audited. A compromised package release, transitive dependency, repository default branch, or browser installer artifact could introduce attacker-controlled code.

Installing the package globally broadens its effect beyond the project directory. The --with-deps option may also install host-level dependencies, increasing exposure if the command is granted elevated authorization.

Attack Path

  1. An attacker compromises the upstream npm package, a transitive dependency, the repository's default branch, or an installer artifact.
  2. The attacker publishes malicious code under the same mutable package name or upstream source.
  3. A user follows the documented installation procedure without verifying a fixed version, commit, or integrity digest.
  4. npm lifecycle behavior, the build process, or the agent-browser install command executes the attacker-controlled content.
  5. The malicious content operates with the privileges of the invoking user and can potentially access files, environment variables, browser data, and writable system resources av ...[truncated 503 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin agent-browser to an explicitly reviewed release instead of installing the package without a version:
    bash
    npm install -g agent-browser@<reviewed-version>
  2. For source installations, check out a verified immutable commit:
    bash
    git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
git checkout --detach <verified-commit-sha>
  3. Verify the selected release or commit against an authenticated upstream release and document the expected digest or signature.
  4. Use a committed lockfile with frozen dependency resolution, such as pnpm install --frozen-lockfile, when building from source.
  5. Prefer project-local installation over global installation where practical.
  6. Document what agent-browser install --with-deps changes and require explicit user approval before any privileged system modification.
  7. Run installation and browser automation in a sandbox or restricted account with access only to required files and credentials.
  8. Establish a dependency-review process before updating the pinned package version, commit, lockfile, or browser binaries.

T08 · Insecure Dependencies

Warning
Location
CONTRIBUTING.md:17
Finding

Explicit Installation of an Unreviewed Latest Package Release

Content
View full analysis

Vulnerability Details

File Location: CONTRIBUTING.md, lines 17–21
Vulnerability Type: Mutable latest-version dependency installation
Risk Level: Medium

Vulnerable Code

markdown
1. Install the latest version
   ```bash
   npm install -g agent-browser@latest
   ```

Technical Analysis

The contribution guide explicitly instructs users to install the latest npm release globally. The latest distribution tag is mutable and can resolve to code that did not exist when this Skill was reviewed. No package version, integrity digest, signature, or other immutable verification mechanism is provided.

npm installation may execute package lifecycle scripts and install transitive dependencies. Therefore, compromise of the package, its release process, or one of its dependencies could turn this troubleshooting step into an arbitrary-code-execution path.

Attack Path

  1. An attacker gains control of the upstream npm package publication process or introduces malicious code into a dependency used by a new release.
  2. The compromised release is assigned the npm latest distribution tag.
  3. A contributor follows the issue-reporting instructions and runs npm install -g agent-browser@latest.
  4. npm downloads the compromised package and dependencies and may execute associated lifecycle scripts.
  5. Attacker-controlled code executes with the contributor's user privileges and modifies or reads resources accessible to that account.

Impact Assessment

Exploitation could provide arbitrary code execution under the invoking account. Because installation is global, it may also alter shared user-level Node.js binaries or modules and affect subsequent commands outside this project. Accessible source files, environment variables, local credentials, browser state, and other user-writable resources may be exposed or modified.

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with a specifically reviewed package version.
  2. Record the approved version in the project documentation and update it only after security review.
  3. Verify package provenance and integrity through npm registry metadata, release signatures where available, and an expected package digest.
  4. Prefer a project-local, lockfile-controlled development dependency rather than a global installation.
  5. Disable package lifecycle scripts during initial inspection where operationally feasible, then enable only scripts that have been reviewed.
  6. Perform installation in an isolated environment with minimal filesystem, credential, and network access.
  7. Add a documented update procedure that reviews upstream changes and transitive dependency differences before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation promotes screenshots, PDFs, video recording, network request logging, and cookie/localStorage inspection without cautioning that these features may capture secrets, personal data, page content, and auth tokens. In a headless agent workflow, these artifacts are easy to persist, exfiltrate, or mishandle, especially when operating on real user sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly instructs users to save and later reload authenticated browser state, but it does not warn that the resulting file may contain session cookies, tokens, and other authentication artifacts. In an agent context, this can lead to credential persistence on disk, accidental sharing, or reuse by other processes, enabling unauthorized account access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
97% confidence
Finding

Saving and loading browser session state creates durable authentication persistence, which can bypass reauthentication and allow account takeover if the state file is copied or reused. Because this is presented as a convenience feature without safeguards, users may unknowingly store live session material insecurely.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
97% confidence
Finding

The example normalizes reusing saved authenticated state across sessions, which increases the chance that agents or users retain long-lived session artifacts beyond their intended scope. If mishandled, these files can grant direct access to the authenticated application without needing usernames or passwords.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Static analysis

No suspicious patterns detected.