ClawHub
Back to skill

Security audit

Handy01 Agent Browser

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is coherent, but it needs review because it encourages saving reusable login state and manipulating cookies/storage without safety boundaries.

Install only if you are comfortable with a skill that can help an agent automate authenticated browser sessions. Keep any saved auth JSON files private, short-lived, access-controlled, and deleted after use; avoid using this with high-sensitivity accounts unless you can isolate the environment. Prefer pinning the npm package version and reviewing downloads before using the install commands, especially --with-deps.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:197
Finding
Unpinned Global Dependency Installation and External Component Download## Vulnerability Details **File Location**: `SKILL.md:197-199` **Vulnerability Type**: Unpinned third-party dependency and mutable external downloads **Risk Level**: Medium **Vulnerable Code**: ```bash npm install -g agent-browser agent-browser install # Download Chromium agent-browser install --with-deps # Linux: + system deps ``` ### Technical Analysis The installation instructions globally install `agent-browser` without specifying a reviewed version or integrity value. Consequently, the package resolved by npm at installation time may differ from the version that was originally reviewed. npm package installation may also execute lifecycle scripts with the invoking user's permissions. The subsequently installed command is instructed to download Chromium and, through `--with-deps`, install operating-system dependencies. These additional components are obtained at execution time and are not pinned or integrity-verified in the Skill documentation. The effective installation behavior can therefore change independently of this Skill package. This is a supply-chain weakness rather than evidence that the currently published `agent-browser` package is malicious. Exploitation requires compromise, replacement, or an unsafe future release of the package or one of its retrieved components. ### Attack Path 1. An attacker compromises the relevant npm package, its publication account, a transitive dependency, or an external component distribution channel. 2. The attacker publishes a malicious or compromised version under the package name used by the documentation. 3. A user follows `SKILL.md` and runs `npm install -g agent-browser` without a version constraint. 4. npm resolves the mutable package version and installs it globally; malicious package code or lifecycle scripts execute with the user's privileges. 5. The user invokes `agent-browser install` or `agent-browser install --with-deps`, allowing ...[truncated 1012 chars]
Remediation
## Remediation Suggestions 1. Pin `agent-browser` to a specifically reviewed version rather than installing the latest mutable release, for example: ```bash npm install --global agent-browser@<reviewed-version> ``` 2. Publish and verify the expected npm integrity digest and package provenance before installation. 3. Prefer a project-local installation governed by a committed lockfile instead of a global installation. 4. Install with lifecycle scripts disabled where compatible, and separately review any scripts that are required: ```bash npm install --ignore-scripts agent-browser@<reviewed-version> ``` 5. Pin and verify the Chromium version and checksum downloaded by the tool, and document the expected download origin. 6. Avoid running the installer as root or administrator. Review the exact operating-system packages before approving `--with-deps`. 7. Perform installation in a restricted container or sandbox with minimal filesystem, credential, and network access. 8. Add dependency monitoring and require a new security review before updating the pinned package or downloaded browser version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly recommends saving and loading browser authentication state to skip login flows, but it provides no warning that these state files can contain reusable session cookies and local storage tokens. In an agent context, this omission can lead to insecure handling, sharing, or reuse of privileged session material across tasks, users, or environments.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill documents commands for reading and modifying cookies and browser storage without any safety guidance about the sensitivity of those values or the risks of tampering with them. In a headless agent workflow, this increases the chance that secrets in cookies/localStorage are exposed in logs, reused improperly, or altered in ways that bypass normal authentication and integrity controls.

Static analysis

No suspicious patterns detected.