Handy01 Agent Browser

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:50 AM UTC
• Version: 0.1.2

Overview

This browser automation skill is coherent, but it needs review because it encourages saving reusable login state and manipulating cookies/storage without safety boundaries.

Install only if you are comfortable with a skill that can help an agent automate authenticated browser sessions. Keep any saved auth JSON files private, short-lived, access-controlled, and deleted after use; avoid using this with high-sensitivity accounts unless you can isolate the environment. Prefer pinning the npm package version and reviewing downloads before using the install commands, especially --with-deps.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:197

Finding

Unpinned Global Dependency Installation and External Component Download

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:197-199
Vulnerability Type: Unpinned third-party dependency and mutable external downloads
Risk Level: Medium

Vulnerable Code:

bash

npm install -g agent-browser
agent-browser install                     # Download Chromium
agent-browser install --with-deps         # Linux: + system deps

Technical Analysis

The installation instructions globally install agent-browser without specifying a reviewed version or integrity value. Consequently, the package resolved by npm at installation time may differ from the version that was originally reviewed. npm package installation may also execute lifecycle scripts with the invoking user's permissions.

The subsequently installed command is instructed to download Chromium and, through --with-deps, install operating-system dependencies. These additional components are obtained at execution time and are not pinned or integrity-verified in the Skill documentation. The effective installation behavior can therefore change independently of this Skill package.

This is a supply-chain weakness rather than evidence that the currently published agent-browser package is malicious. Exploitation requires compromise, replacement, or an unsafe future release of the package or one of its retrieved components.

Attack Path

1. An attacker compromises the relevant npm package, its publication account, a transitive dependency, or an external component distribution channel.
2. The attacker publishes a malicious or compromised version under the package name used by the documentation.
3. A user follows SKILL.md and runs npm install -g agent-browser without a version constraint.
4. npm resolves the mutable package version and installs it globally; malicious package code or lifecycle scripts execute with the user's privileges.
5. The user invokes agent-browser install or agent-browser install --with-deps, allowing ...[truncated 1012 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin agent-browser to a specifically reviewed version rather than installing the latest mutable release, for example:

   bash

   npm install --global agent-browser@<reviewed-version>
   

2. Publish and verify the expected npm integrity digest and package provenance before installation.
3. Prefer a project-local installation governed by a committed lockfile instead of a global installation.
4. Install with lifecycle scripts disabled where compatible, and separately review any scripts that are required:

   bash

   npm install --ignore-scripts agent-browser@<reviewed-version>
   

5. Pin and verify the Chromium version and checksum downloaded by the tool, and document the expected download origin.
6. Avoid running the installer as root or administrator. Review the exact operating-system packages before approving --with-deps.
7. Perform installation in a restricted container or sandbox with minimal filesystem, credential, and network access.
8. Add dependency monitoring and require a new security review before updating the pinned package or downloaded browser version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly recommends saving and loading browser authentication state to skip login flows, but it provides no warning that these state files can contain reusable session cookies and local storage tokens. In an agent context, this omission can lead to insecure handling, sharing, or reuse of privileged session material across tasks, users, or environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documents commands for reading and modifying cookies and browser storage without any safety guidance about the sensitivity of those values or the risks of tampering with them. In a headless agent workflow, this increases the chance that secrets in cookies/localStorage are exposed in logs, reused improperly, or altered in ways that bypass normal authentication and integrity controls.

Content

No source excerpt is available for this finding.