Security audit

Agent Browser Cli.Bak.Skip

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed browser-automation helper, but it gives broad account, form-submission, scheduled-action, and global-install guidance without enough scoping or safety controls.

Review this before installing if you plan to use it on logged-in sites or accounts. Prefer a pinned, locally installed CLI version, avoid administrative installs, do not store plaintext passwords in scripts, and require explicit confirmation before submitting forms, clicking account actions, capturing sensitive screenshots, or setting up recurring check-ins.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:122
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 122–126
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code:

bash
## 依赖安装如果 agent-browser 未安装： ```bash npm install -g agent-browser agent-browser install

text
### Technical Analysis The installation procedure installs `agent-browser` from the npm registry without specifying an exact version or verifying package integrity. As a result, the package content installed by users can differ from the version reviewed when this skill was published. The `-g` option installs the package globally. Depending on the local npm configuration, this may require or inherit elevated permissions and exposes a broader environment than a project-local installation. npm package installation can also execute package lifecycle scripts. The subsequent `agent-browser install` command may download and install additional browser components whose versions and integrity are not constrained by this skill. This is a supply-chain weakness rather than evidence that the current package is malicious. Exploitation requires compromise or malicious replacement of the package, one of its dependencies, or components fetched by its installer. ### Attack Path 1. An attacker compromises the `agent-browser` npm package, a transitive dependency, its publisher account, or an external component source used by `agent-browser install`. 2. The attacker publishes a malicious release or substitutes a downloaded component. 3. A user follows the skill instructions and runs `npm install -g agent-browser` without an exact version or integrity constraint. 4. npm retrieves the attacker-controlled release and may execute its lifecycle scripts during installation. 5. The user runs `agent-browser install`, potentially retrieving or executing further compromised components. 6. Malicious code executes with the privileges of the installing u ...[truncated 589 chars]
Remediation: View remediation
Remediation Suggestions

Pin agent-browser to a reviewed exact version, for example agent-browser@X.Y.Z, rather than resolving the latest release.

Record and verify the package integrity hash and maintain a lockfile where the installation workflow supports one.

Prefer a project-local installation with npm ci and a committed lockfile instead of a global installation.

Verify the package name, official publisher, registry source, and release provenance before installation.

Disable npm lifecycle scripts during initial installation when compatible with the package, then explicitly run only reviewed setup steps.

Pin and verify browser binaries or other components downloaded by agent-browser install.

Do not perform installation with administrative privileges unless strictly required.

Document the expected package version, publisher identity, component sources, and checksums so users can validate them before execution.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger conditions are broad enough to overlap with many ordinary requests involving websites, forms, and content retrieval, which can cause the skill to activate in situations where browser automation is unnecessary or risky. In a browser-control skill, overbroad activation increases the chance of unintended login flows, form submissions, clicks, or data collection on behalf of the user without sufficiently clear scoping.
Content: No source excerpt is available for this finding.

Missing User Warnings