Agent Browser

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:48 PM UTC
• Version: 0.1.0

Overview

This appears to be a legitimate browser automation skill, but it needs Review because it can reuse live browser sessions, persist authentication data, and run an unpinned external CLI with guardrails off by default.

Install only if you are comfortable giving an agent strong browser control. Prefer a dedicated disposable browser profile, enable domain allowlists, content boundaries, output limits, and a restrictive action policy before use. Avoid connecting it to your normal Chrome profile, treat saved state files, recordings, screenshots, HARs, PDFs, and traces as sensitive, encrypt or delete auth state promptly, and use a pinned verified agent-browser version instead of floating npx/latest installs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:4
• Finding: Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4-9`, `SKILL.md:418`, `SKILL.md:672` **Vulnerability Type**: Unverified and unpinned third-party dependencies **Risk Level**: High ### Vulnerable Code ```yaml allowed-tools: Bash(npx agent-browser:*), Bash(agent-browser:*) ``` ```markdown The CLI uses Chrome/Chromium via CDP directly. Install via `npm i -g agent-browser`, `brew install agent-browser`, or `cargo install agent-browser`. Run `agent-browser install` to download Chrome. Run `agent-browser upgrade` to update to the latest version. ``` ```markdown **Requirements:** macOS with Xcode, Appium (`npm install -g appium && appium driver install xcuitest`) ``` ```markdown Lightpanda does not support `--extension`, `--profile`, `--state`, or `--allow-file-access`. Install Lightpanda from https://lightpanda.io/docs/open-source/installation. ``` ### Technical Analysis The Skill authorizes `npx agent-browser:*` and recommends installing or upgrading multiple third-party components without pinning exact versions, validating release signatures, or checking artifact hashes. An `npx` invocation may download and execute the package version currently resolved by the package registry. The `agent-browser upgrade` command similarly changes the locally executed implementation after the Skill has been reviewed. The effective code therefore depends on mutable external package repositories and future releases rather than a verified version. This is a supply-chain weakness rather than evidence that the currently named packages are malicious. Exploitation requires compromise of a package, registry account, distribution endpoint, or future release. ### Attack Path 1. An attacker compromises a referenced package, publisher account, registry entry, or downloadable browser artifact. 2. A malicious version is published under a dependency name recommended by the Skill. 3. The Agent runs `npx agent-browser`, an installation command, or `agent-browser upgrade`. 4 ...[truncated 802 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an exact reviewed version rather than installing the latest release. 2. Remove implicit package retrieval from the allowed `npx` command. Require a preinstalled, verified binary. 3. Verify downloaded artifacts using cryptographic hashes or publisher signatures. 4. Use lockfiles and trusted registries where applicable. 5. Disable automatic upgrades in Agent workflows. Review and approve updates separately. 6. Pin Appium, its drivers, the browser binary, and alternative browser engines to verified releases. 7. Run browser tooling in a sandboxed, minimally privileged account with restricted filesystem and network access. 8. Document the expected package publisher, registry, version, checksum, and update process. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:53
• Finding: Overbroad Export of Authenticated Browser State Through CDP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:53-62`; `references/authentication.md:22-63` **Vulnerability Type**: Excessive access to authenticated browser cookies and storage **Risk Level**: High ### Vulnerable Code From `SKILL.md`: ```markdown **Option 1: Import auth from the user's browser (fastest for one-off tasks)** ```bash # Connect to the user's running Chrome (they're already logged in) agent-browser --auto-connect state save ./auth.json # Use that auth state agent-browser --state ./auth.json open https://app.example.com/dashboard ``` State files contain session tokens in plaintext -- add to `.gitignore` and delete when no longer needed. Set `AGENT_BROWSER_ENCRYPTION_KEY` for encryption at rest. ``` From `references/authentication.md`: ```bash # Auto-discover the running Chrome and save its cookies + localStorage agent-browser --auto-connect state save ./my-auth.json ``` ```markdown This works for any site, including those with complex OAuth flows, SSO, or 2FA -- as long as Chrome already has valid session cookies. > **Security note:** State files contain session tokens in plaintext. Add them to `.gitignore`, delete when no longer needed, and set `AGENT_BROWSER_ENCRYPTION_KEY` for encryption at rest. ``` The same guide also acknowledges the underlying access level: ```markdown > **Security note:** `--remote-debugging-port` exposes full browser control on localhost. Any local process can connect and read cookies, execute JS, etc. Only use on trusted machines and close Chrome when done. ``` ### Technical Analysis The documented workflow connects to an existing Chrome instance that may contain the user's normal authenticated sessions and exports cookies and local storage through CDP. The state-save command is not shown with a target-origin restriction before extraction. CDP access represents full control over the connected browser, not merely access to the single website involved in the automation task. A general personal b ...[truncated 1483 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not attach automation to a user's ordinary browser profile. 2. Create a dedicated, disposable browser profile containing only the target application's session. 3. Require explicit user confirmation before connecting through CDP or exporting authentication state. 4. Restrict state export to explicitly approved origins where the tool supports origin filtering. 5. Enable a strict domain allowlist before loading or using imported state. 6. Bind remote-debugging interfaces only to a protected local endpoint and close the browser immediately after use. 7. Encrypt exported state and store it in a user-private directory with mode `0600`. 8. Revoke affected sessions after temporary state is no longer required. 9. Prefer a scoped authentication vault or short-lived service token over extracting a user's interactive browser session. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/session-management.md:62
• Finding: Plaintext Authentication State Stored at Predictable or Project-Local Paths<![CDATA[ ## Vulnerability Details **File Location**: `references/session-management.md:62-83`; `templates/authenticated-session.sh:25-27`, `templates/authenticated-session.sh:97-100`; `SKILL.md:57-62` **Vulnerability Type**: Plaintext sensitive data and unsafe temporary-file handling **Risk Level**: High ### Vulnerable Code From `references/session-management.md`: ```bash #!/bin/bash # Save login state once, reuse many times STATE_FILE="/tmp/auth-state.json" # Check if we have saved state if [[ -f "$STATE_FILE" ]]; then agent-browser state load "$STATE_FILE" agent-browser open https://app.example.com/dashboard else # Perform login agent-browser open https://app.example.com/login agent-browser snapshot -i agent-browser fill @e1 "$USERNAME" agent-browser fill @e2 "$PASSWORD" agent-browser click @e3 agent-browser wait --load networkidle # Save for future use agent-browser state save "$STATE_FILE" fi ``` From `templates/authenticated-session.sh`: ```bash LOGIN_URL="${1:?Usage: $0 <login-url> [state-file]}" STATE_FILE="${2:-./auth-state.json}" ``` ```bash # # Save state for future runs # echo "Saving state to $STATE_FILE" # agent-browser state save "$STATE_FILE" # echo "Login successful" ``` The primary documentation explicitly describes the state as plaintext: ```markdown State files contain session tokens in plaintext -- add to `.gitignore` and delete when no longer needed. Set `AGENT_BROWSER_ENCRYPTION_KEY` for encryption at rest. ``` ### Technical Analysis Authentication state contains cookies and web storage that can act as bearer credentials. The documentation saves this state without mandatory encryption. It uses either a predictable shared temporary path, `/tmp/auth-state.json`, or a project-local default, `./auth-state.json`. The examples do not establish a restrictive `umask`, atomically create a private state file, verify ownership, reject symbolic links, or enforce mode `0600`. A predictable path ...[truncated 1546 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make encryption mandatory whenever authentication state is saved. 2. Refuse to save authenticated state if `AGENT_BROWSER_ENCRYPTION_KEY` is absent. 3. Generate and manage the encryption key through an operating-system secret store or CI secret manager rather than leaving it in project files. 4. Use `umask 077` before creating sensitive files. 5. Store state under a user-private directory rather than a shared `/tmp` path or project root. 6. Create temporary directories with `mktemp -d`, verify ownership, and remove them with an EXIT trap. 7. Create files atomically with mode `0600` and reject pre-existing symbolic links. 8. Add comprehensive state patterns to `.gitignore`, artifact exclusion rules, and secret-scanning policies. 9. Prefer short-lived sessions and delete saved state immediately after use. 10. Revoke server-side sessions when a state file may have been disclosed. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:422
• Finding: AI Browser Security Boundaries Are Disabled by Default<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:422-470` **Vulnerability Type**: Unsafe default configuration for untrusted web content and browser actions **Risk Level**: High ### Vulnerable Code ```markdown ## Security All security features are opt-in. By default, agent-browser imposes no restrictions on navigation, actions, or output. ### Content Boundaries (Recommended for AI Agents) Enable `--content-boundaries` to wrap page-sourced output in markers that help LLMs distinguish tool output from untrusted page content: ```bash export AGENT_BROWSER_CONTENT_BOUNDARIES=1 agent-browser snapshot ``` ### Domain Allowlist Restrict navigation to trusted domains. Wildcards like `*.example.com` also match the bare domain `example.com`. Sub-resource requests, WebSocket, and EventSource connections to non-allowed domains are also blocked. Include CDN domains your target pages depend on: ```bash export AGENT_BROWSER_ALLOWED_DOMAINS="example.com,*.example.com" agent-browser open https://example.com # OK agent-browser open https://malicious.com # Blocked ``` ### Action Policy Use a policy file to gate destructive actions: ```bash export AGENT_BROWSER_ACTION_POLICY=./policy.json ``` Example `policy.json`: ```json { "default": "deny", "allow": ["navigate", "snapshot", "click", "scroll", "wait", "get"] } ``` Auth vault operations (`auth login`, etc.) bypass action policy but domain allowlist still applies. ### Output Limits Prevent context flooding from large pages: ```bash export AGENT_BROWSER_MAX_OUTPUT=50000 ``` ``` ### Technical Analysis The Skill is specifically designed for AI agents and routinely sends webpage-derived snapshots, text, labels, and attributes into model context. Webpage content is attacker-controlled input and may contain instructions designed to manipulate an Agent. The project provides useful mitigations—content boundaries, domain allowlists, output limits, and action policies—but explicitly leaves all o ...[truncated 1721 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enable content boundaries by default for all AI-driven sessions. 2. Require a strict domain allowlist before navigation, including explicitly approved CDN and API domains. 3. Apply a default-deny action policy automatically. 4. Require explicit user confirmation for credential entry, form submission, file upload, download, clipboard access, local-file access, authentication-state export, and JavaScript evaluation. 5. Treat all page text, accessibility labels, iframe output, console messages, and downloaded content as untrusted data. 6. Enforce output-size limits by default to reduce context-flooding attacks. 7. Prevent page content from modifying system instructions, safety constraints, domain policy, or action policy. 8. Isolate authenticated and unauthenticated browsing in separate disposable sessions. 9. Keep auth-vault operations within the domain allowlist and add confirmation gates where they can create authenticated side effects. 10. Log sensitive actions and display the target origin and requested effect before execution. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: Connecting to a user's existing Chrome instance and importing authenticated state exposes live session cookies and tokens from the user's personal browser environment. In an agent setting, this is especially dangerous because it can silently expand access well beyond the requested site and enable account takeover or privacy breaches if mishandled.

Context Leakage

High

• Category: Data Exfiltration

Content

agent-browser --headed open https://example.com
agent-browser highlight @e1          # Highlight element
agent-browser inspect                # Open Chrome DevTools for the active page
agent-browser record start demo.webm # Record session
agent-browser profiler start         # Start Chrome DevTools profiling
agent-browser profiler stop trace.json # Stop and save profile (path optional)
```

• Confidence: 85% confidence
• Finding: Session recording can capture everything visible during automation, including credentials, personal data, internal application content, and security tokens shown on screen. In an agent-operated browser workflow, saved recordings materially raise the risk of context leakage and long-lived sensitive artifacts.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

ication](#restoring-authentication)
- [OAuth / SSO Flows](#oauth--sso-flows)
- [Two-Factor Authentication](#two-factor-authentication)
- [HTTP Basic Auth](#http-basic-auth)
- [Cookie-Based Auth](#cookie-based-auth)
- [Token Refresh Handling](#token-refresh-handling)
- [Security Best Practices](#security-best-practices)

## Import Auth from Your Browser

The fastest way to authenticate is to reuse cookies from a Chrome session you are already logged into.

**Step 1: Start Chrome with remote debugging**

```bash
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --remote-debugging-port=9222

# Linux
google-chrome --remote-debugging-port=9222

# Windows
"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222
```

Log in to your target site(s) in this Chrome window as you normally would.

> **Security note:** `--remote-debugging-port` exposes full browser control on localhost. Any local process can connect and read cookies, execute JS, etc.

• Confidence: 91% confidence
• Finding: The documentation explicitly instructs users to launch Chrome with a remote debugging port and then extract cookies/localStorage into a reusable state file. Although framed as convenience and accompanied by warnings, this pattern enables session/token theft and browser takeover by any local process while debugging is enabled, and normalizes exporting live authenticated state in plaintext-reusable form.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

3. **Clean up after automation**
   ```bash
   agent-browser cookies clear
   rm -f ./auth-state.json
   ```

4. **Use short-lived sessions for CI/CD**

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "*.auth-state.json" >> .gitignore

# Delete after use
rm /tmp/auth-state.json
```

### 4. Timeout Long Sessions

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: This example records a login workflow while filling an email and password field, which teaches users to create a video artifact containing authentication activity and potentially the typed secret or other sensitive post-login content. In the context of a browser automation skill, such recordings are likely to be stored in CI artifacts, shared for debugging, or retained on disk, increasing the chance of credential exposure and account compromise.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The skill manifest references `npx agent-browser` without version pinning, so execution may resolve to an unreviewed package release at runtime. For an automation skill with browser, filesystem, and credential-adjacent functionality, this materially increases supply-chain compromise risk.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger language is very broad and could cause the browser automation skill to be selected for loosely related requests. Over-invocation matters here because the skill exposes powerful actions including authentication handling, downloads, local file access, and browser-state operations.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The manifest allows execution via `npx agent-browser:*` without pinning a specific package version, which permits fetching whatever version is current at invocation time. In an agent context, that creates a supply-chain risk where a compromised or malicious upstream release could be executed with the skill's granted shell capabilities.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill describes importing browser auth and handling plaintext session state without a prominent upfront warning or mandatory consent step. That omission increases the likelihood that operators or downstream agents use sensitive session mechanisms without appreciating the privacy and account-security implications.

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: Clipboard read/write gives the agent access to data outside the active browser task, including potentially sensitive copied secrets, tokens, or personal information. That exceeds normal browser automation needs and can be abused for exfiltration or unintended cross-task data leakage.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The documented `eval` feature enables arbitrary JavaScript execution in the browser context, which is broader than ordinary page interaction and extraction. In an LLM-driven workflow, this increases the chance of unsafe or over-privileged actions such as script-driven data harvesting, DOM manipulation, or bypassing safer higher-level command boundaries.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Configuration File

Create `agent-browser.json` in the project root for persistent settings:

```json
{

• Confidence: 71% confidence
• Finding: Persisting browser configuration and profiles in project-local files can cause session state, browsing artifacts, or security-relevant settings to survive beyond the task. In shared workspaces or repositories, this creates a risk of accidental credential leakage, state reuse across tasks, or committing sensitive browser data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The cookies and localStorage commands expose and modify highly sensitive browser data, including session identifiers, CSRF tokens, and application secrets, but the docs do not warn about that sensitivity. In this skill's context, an AI agent could be prompted to dump or alter authenticated state, increasing the chance of credential theft, account takeover, or corruption of user sessions.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The comment on L220 says `Simple expressions only`, but the surrounding command reference explicitly documents `eval -b` and `eval --stdin` for executing any JavaScript. This is an active documentation contradiction about execution scope, which materially affects user understanding of the command's capabilities.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented state save/load commands persist cookies, storage, and auth state to disk and restore them later, but the reference omits a warning that these files may contain bearer sessions and other secrets. In an agent-oriented browser automation skill, that makes credential capture, unintended reuse, and lateral movement more dangerous because agents may save or load state automatically across tasks.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save cookies, storage, auth state
agent-browser state load auth.json    # Restore saved state
```

## Global Options

• Confidence: 93% confidence
• Finding: `state load auth.json` enables restoration of previously saved authenticated browser state, which can effectively import live sessions into a new automation run. In an agent-browser skill, this increases the risk of replaying stolen sessions, crossing user/task boundaries, and performing actions as another identity if state files are reused or mishandled.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This documentation encourages collecting and saving Chrome trace data to JSON files but does not warn that performance traces can include sensitive browsing metadata, URLs, timing of user interactions, page structure details, and potentially other application-specific telemetry. In an agent-browser skill, this is more dangerous because the tool is explicitly used for automated interaction with websites, including logins and form submissions, making it likely that traces will be captured during sensitive sessions and then persisted to disk or shared for debugging.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation shows authenticated proxy credentials embedded directly in environment variables and proxy URLs, but does not warn that these secrets may be exposed through shell history, process listings, logs, CI output, or shared terminal sessions. In a browser automation skill, users are likely to copy these examples into scripts and operational environments, increasing the chance of credential leakage and reuse of sensitive corporate proxy accounts.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Load Session State

```bash
# Restore saved state
agent-browser state load /path/to/auth-state.json

# Continue with authenticated session

• Confidence: 55% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The iframe section shows direct interaction with payment fields including a full card number and a Pay button, but provides no caution about processing or transmitting financial data. In markdown guidance, operations affecting privacy or sensitive user data should include explicit warnings so users understand the implications.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation promotes browser video recording and screenshots but omits any warning that these artifacts can capture sensitive on-screen content such as credentials, session data, personal information, and internal application state. In an agent-driven browser automation skill, users may record real workflows against live systems, making accidental retention or sharing of sensitive visual data a realistic risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This workflow automatically writes full-page screenshots, extracted body text, and a PDF of the current page to disk, which can capture credentials, personal data, session-linked content, or other sensitive material without any consent prompt, redaction step, or retention warning. In the context of a browser automation skill, this is more dangerous because the target page may be authenticated or private, so the saved artifacts can persist sensitive information beyond the browsing session.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: Screenshots, PDFs, and recordings can capture passwords, personal data, tokens, account pages, and other confidential on-screen information, yet the documentation presents them without any caution. In a browser automation skill, silent capture features materially raise data-exposure risk because agents may archive or return these artifacts outside the original trust boundary.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This markdown file demonstrates entering an email and password into a form, and later includes card payment details, but does not warn that the skill may process sensitive credentials or financial data during browser interactions. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or privacy.

Static analysis

No suspicious patterns detected.