Agent Browser Cli.Bak

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:28 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is coherent, but it needs review because it enables live account actions, scheduled automation, and a mutable global npm install without enough safeguards.

Review before installing. Use this only for sites and accounts where automated actions are allowed, confirm every login, submit, purchase, or check-in before it runs, avoid saving sensitive screenshots or page dumps, and prefer a pinned local install over a global npm install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:126

Finding

Unpinned Global Installation and Execution of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 126–127
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Complete Code Snippet:

bash

npm install -g agent-browser
agent-browser install

Technical Analysis

The installation instructions globally install agent-browser without pinning an exact package version or verifying package integrity and provenance. The subsequent command executes the installed package. Therefore, the code that runs is determined by whichever release the npm registry resolves at installation time rather than by a version reviewed with this Skill.

Global npm installation may execute package lifecycle scripts and places executable tooling in a globally accessible location. If the package, a transitive dependency, the publisher account, or the package distribution channel is compromised, attacker-controlled code could run with the permissions of the user performing the installation. No evidence establishes that the named package is currently malicious; the vulnerability is the unsafe, mutable dependency acquisition process.

Attack Path

1. An attacker compromises the agent-browser package, its publisher account, or a dependency in its supply chain.
2. The attacker publishes a malicious release or injects malicious installation/runtime behavior.
3. A user or agent follows the documented command npm install -g agent-browser.
4. npm resolves and installs the attacker-controlled version because no exact version or integrity value is specified.
5. Malicious code executes through an npm lifecycle script, the installed CLI, or the subsequent agent-browser install command.
6. The payload operates with the invoking user's permissions and may affect globally installed tooling or user-accessible data.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account performing the instal ...[truncated 442 chars]

Remediation

View remediation

Remediation Suggestions

• Pin agent-browser to a reviewed exact version rather than allowing npm to resolve the latest release.
• Record and verify package integrity and provenance using a lockfile, trusted registry configuration, checksums, signatures, or npm provenance attestations as applicable.
• Prefer a project-local installation in an isolated, least-privileged environment instead of modifying global tooling.
• Review the pinned package, its lifecycle scripts, and its transitive dependency tree before deployment.
• Disable npm lifecycle scripts during installation when they are unnecessary, and explicitly run only reviewed setup steps.
• Avoid executing installation commands with administrator or root privileges.
• Document the expected official package publisher and registry to reduce package-substitution and registry-confusion risks.
• Establish controlled dependency-update procedures so that new versions are reviewed and tested before adoption.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are overly broad and can cause this browser-automation skill to activate for general browsing or research tasks, not just clearly consented automation. Because the skill can click, fill forms, and submit actions on live sites, over-selection increases the chance of unintended account actions, data submission, or navigation to sensitive pages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill provides workflows for sign-in, form filling, button clicking, and cron-based scheduled actions without warning about account, consent, or irreversible state changes. In this context, omission of guardrails is dangerous because the tool is specifically designed to perform live actions on behalf of a user, including repeated unattended execution that could alter accounts, submit sensitive data, or violate site expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill encourages extracting page text, HTML, values, and screenshots but does not warn that captured content may include personal data, credentials, session information, or proprietary material. In a browser automation context, silent collection and storage of page content can lead to privacy leakage or accidental retention of sensitive information.

Content

No source excerpt is available for this finding.