Security audit

Agent Browser

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate browser automation skill, but it needs Review because it can reuse live browser sessions, persist authentication data, and run an unpinned external CLI with guardrails off by default.

Install only if you are comfortable giving an agent strong browser control. Prefer a dedicated disposable browser profile, enable domain allowlists, content boundaries, output limits, and a restrictive action policy before use. Avoid connecting it to your normal Chrome profile, treat saved state files, recordings, screenshots, HARs, PDFs, and traces as sensitive, encrypt or delete auth state promptly, and use a pinned verified agent-browser version instead of floating npx/latest installs.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

Location: SKILL.md:4
Finding: Unpinned Third-Party Package Installation and Execution
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:53
Finding: Overbroad Export of Authenticated Browser State Through CDP
Content: View full analysis
**Security note:** State files contain session tokens in plaintext. Add them to `.gitignore`, delete when no longer needed, and set `AGENT_BROWSER_ENCRYPTION_KEY` for encryption at rest. ``` The same guide also acknowledges the underlying access level: ```markdown > **Security note:** `--remote-debugging-port` exposes full browser control on localhost. Any local process can connect and read cookies, execute JS, etc. Only use on trusted machines and close Chrome when done. ``` ### Technical Analysis The documented workflow connects to an existing Chrome instance that may contain the user's normal authenticated sessions and exports cookies and local storage through CDP. The state-save command is not shown with a target-origin restriction before extraction. CDP access represents full control over the connected browser, not merely access to the single website involved in the automation task. A general personal b ...[truncated 1483 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/session-management.md:62
Finding: Plaintext Authentication State Stored at Predictable or Project-Local Paths
Content: View full analysis
[state-file]}" STATE_FILE="${2:-./auth-state.json}" ``` ```bash # # Save state for future runs # echo "Saving state to $STATE_FILE" # agent-browser state save "$STATE_FILE" # echo "Login successful" ``` The primary documentation explicitly describes the state as plaintext: ```markdown State files contain session tokens in plaintext -- add to `.gitignore` and delete when no longer needed. Set `AGENT_BROWSER_ENCRYPTION_KEY` for encryption at rest. ``` ### Technical Analysis Authentication state contains cookies and web storage that can act as bearer credentials. The documentation saves this state without mandatory encryption. It uses either a predictable shared temporary path, `/tmp/auth-state.json`, or a project-local default, `./auth-state.json`. The examples do not establish a restrictive `umask`, atomically create a private state file, verify ownership, reject symbolic links, or enforce mode `0600`. A predictable path ...[truncated 1546 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:422
Finding: AI Browser Security Boundaries Are Disabled by Default
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Connecting to a user's existing Chrome instance and importing authenticated state exposes live session cookies and tokens from the user's personal browser environment. In an agent setting, this is especially dangerous because it can silently expand access well beyond the requested site and enable account takeover or privacy breaches if mishandled.
Content: No source excerpt is available for this finding.

Context Leakage

High

Category: Data Exfiltration
Confidence: 85% confidence
Finding: Session recording can capture everything visible during automation, including credentials, personal data, internal application content, and security tokens shown on screen. In an agent-operated browser workflow, saved recordings materially raise the risk of context leakage and long-lived sensitive artifacts.
Content: Scanner excerpt · SKILL.md (reported line 380)May include surrounding context.
agent-browser --headed open https://example.com agent-browser highlight @e1 # Highlight element agent-browser inspect # Open Chrome DevTools for the active page agent-browser record start demo.webm # Record session agent-browser profiler start # Start Chrome DevTools profiling agent-browser profiler stop trace.json # Stop and save profile (path optional)

text

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 91% confidence
Finding: The documentation explicitly instructs users to launch Chrome with a remote debugging port and then extract cookies/localStorage into a reusable state file. Although framed as convenience and accompanied by warnings, this pattern enables session/token theft and browser takeover by any local process while debugging is enabled, and normalizes exporting live authenticated state in plaintext-reusable form.
Content: Scanner excerpt · references/authentication.md (reported line 24)May include surrounding context.
ication](#restoring-authentication)

OAuth / SSO Flows

Two-Factor Authentication

HTTP Basic Auth

Cookie-Based Auth

Token Refresh Handling

Security Best Practices

Import Auth from Your Browser

The fastest way to authenticate is to reuse cookies from a Chrome session you are already logged into.

Step 1: Start Chrome with remote debugging

bash
# macOS "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --remote-debugging-port=9222 # Linux google-chrome --remote-debugging-port=9222 # Windows "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222

Log in to your target site(s) in this Chrome window as you normally would.

Security note: --remote-debugging-port exposes full browser control on localhost. Any local process can connect and read cookies, execute JS, etc.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/authentication.md (reported line 294)May include surrounding context.

Clean up after automation

bash
agent-browser cookies clear rm -f ./auth-state.json

Use short-lived sessions for CI/CD

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/session-management.md (reported line 185)May include surrounding context.
echo "*.auth-state.json" >> .gitignore

Delete after use

rm /tmp/auth-state.json

text
### 4. Timeout Long Sessions

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This example records a login workflow while filling an email and password field, which teaches users to create a video artifact containing authentication activity and potentially the typed secret or other sensitive post-login content. In the context of a browser automation skill, such recordings are likely to be stored in CI artifacts, shared for debugging, or retained on disk, increasing the chance of credential exposure and account compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The skill manifest references npx agent-browser without version pinning, so execution may resolve to an unreviewed package release at runtime. For an automation skill with browser, filesystem, and credential-adjacent functionality, this materially increases supply-chain compromise risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger language is very broad and could cause the browser automation skill to be selected for loosely related requests. Over-invocation matters here because the skill exposes powerful actions including authentication handling, downloads, local file access, and browser-state operations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: The manifest allows execution via npx agent-browser:* without pinning a specific package version, which permits fetching whatever version is current at invocation time. In an agent context, that creates a supply-chain risk where a compromised or malicious upstream release could be executed with the skill's granted shell capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill describes importing browser auth and handling plaintext session state without a prominent upfront warning or mandatory consent step. That omission increases the likelihood that operators or downstream agents use sensitive session mechanisms without appreciating the privacy and account-security implications.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: Clipboard read/write gives the agent access to data outside the active browser task, including potentially sensitive copied secrets, tokens, or personal information. That exceeds normal browser automation needs and can be abused for exfiltration or unintended cross-task data leakage.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The documented eval feature enables arbitrary JavaScript execution in the browser context, which is broader than ordinary page interaction and extraction. In an LLM-driven workflow, this increases the chance of unsafe or over-privileged actions such as script-driven data harvesting, DOM manipulation, or bypassing safer higher-level command boundaries.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 71% confidence
Finding: Persisting browser configuration and profiles in project-local files can cause session state, browsing artifacts, or security-relevant settings to survive beyond the task. In shared workspaces or repositories, this creates a risk of accidental credential leakage, state reuse across tasks, or committing sensitive browser data.
Content: Scanner excerpt · SKILL.md (reported line 628)May include surrounding context.
Configuration File

Create agent-browser.json in the project root for persistent settings:

json
{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The cookies and localStorage commands expose and modify highly sensitive browser data, including session identifiers, CSRF tokens, and application secrets, but the docs do not warn about that sensitivity. In this skill's context, an AI agent could be prompted to dump or alter authenticated state, increasing the chance of credential theft, account takeover, or corruption of user sessions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The comment on L220 says Simple expressions only, but the surrounding command reference explicitly documents eval -b and eval --stdin for executing any JavaScript. This is an active documentation contradiction about execution scope, which materially affects user understanding of the command's capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented state save/load commands persist cookies, storage, and auth state to disk and restore them later, but the reference omits a warning that these files may contain bearer sessions and other secrets. In an agent-oriented browser automation skill, that makes credential capture, unintended reuse, and lateral movement more dangerous because agents may save or load state automatically across tasks.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 93% confidence
Finding: state load auth.json enables restoration of previously saved authenticated browser state, which can effectively import live sessions into a new automation run. In an agent-browser skill, this increases the risk of replaying stolen sessions, crossing user/task boundaries, and performing actions as another identity if state files are reused or mishandled.
Content: Scanner excerpt · references/commands.md (reported line 242)May include surrounding context.
bash
agent-browser state save auth.json # Save cookies, storage, auth state agent-browser state load auth.json # Restore saved state

Global Options

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This documentation encourages collecting and saving Chrome trace data to JSON files but does not warn that performance traces can include sensitive browsing metadata, URLs, timing of user interactions, page structure details, and potentially other application-specific telemetry. In an agent-browser skill, this is more dangerous because the tool is explicitly used for automated interaction with websites, including logins and form submissions, making it likely that traces will be captured during sensitive sessions and then persisted to disk or shared for debugging.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation shows authenticated proxy credentials embedded directly in environment variables and proxy URLs, but does not warn that these secrets may be exposed through shell history, process listings, logs, CI output, or shared terminal sessions. In a browser automation skill, users are likely to copy these examples into scripts and operational environments, increasing the chance of credential leakage and reuse of sensitive corporate proxy accounts.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 55% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/session-management.md (reported line 55)May include surrounding context.
Load Session State

bash
# Restore saved state agent-browser state load /path/to/auth-state.json # Continue with authenticated session

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The iframe section shows direct interaction with payment fields including a full card number and a Pay button, but provides no caution about processing or transmitting financial data. In markdown guidance, operations affecting privacy or sensitive user data should include explicit warnings so users understand the implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation promotes browser video recording and screenshots but omits any warning that these artifacts can capture sensitive on-screen content such as credentials, session data, personal information, and internal application state. In an agent-driven browser automation skill, users may record real workflows against live systems, making accidental retention or sharing of sensitive visual data a realistic risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This workflow automatically writes full-page screenshots, extracted body text, and a PDF of the current page to disk, which can capture credentials, personal data, session-linked content, or other sensitive material without any consent prompt, redaction step, or retention warning. In the context of a browser automation skill, this is more dangerous because the target page may be authenticated or private, so the saved artifacts can persist sensitive information beyond the browsing session.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Screenshots, PDFs, and recordings can capture passwords, personal data, tokens, account pages, and other confidential on-screen information, yet the documentation presents them without any caution. In a browser automation skill, silent capture features materially raise data-exposure risk because agents may archive or return these artifacts outside the original trust boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file demonstrates entering an email and password into a form, and later includes card payment details, but does not warn that the skill may process sensitive credentials or financial data during browser interactions. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or privacy.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T08 · Insecure Dependencies

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Context-Inappropriate Capability

Context Leakage

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

Import Auth from Your Browser

Tool Parameter Abuse

Tool Parameter Abuse

Delete after use

Missing User Warnings

Rp1

Vague Triggers

Rp1

Missing User Warnings

Context-Inappropriate Capability

Context-Inappropriate Capability

Session Persistence

Configuration File

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Session Persistence

Global Options

Missing User Warnings

Missing User Warnings

Session Persistence

Load Session State

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings