Agent S Bridge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 1.0.0

Overview

This skill is a desktop automation bridge, but it overstates a browser-only mode that is not technically enforced and runs an unpinned third-party desktop-control binary.

Review before installing. Use only in a sandbox, VM, or low-privilege account with a test browser profile. Do not rely on `browse` mode as browser-only, pin and verify the `gui-agents` package before use, and avoid running it where sensitive files, logged-in accounts, payment flows, or production systems are accessible.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned High-Privilege Third-Party Dependency

Content

View full analysis

Remediation

View remediation

``` 2. Use a lockfile that also pins all transitive dependencies. 3. Require package hashes through a hashed requirements file: ```bash pip install --require-hashes -r requirements.txt ``` 4. Document and enforce a trusted package index rather than allowing resolution from arbitrary configured indexes. 5. Review package provenance and release signatures before updating the pinned version. 6. Launch the dependency with a minimal environment containing only variables it strictly requires. 7. Isolate the automation process using a dedicated low-privilege operating-system account, container, virtual machine, or equivalent desktop sandbox. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: agent_s_bridge.py:79

Finding

Browser Mode Does Not Enforce the Documented Browser-Only Security Boundary

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description presents this as a functional bridge enabling DeepSeek TUI to drive Agent-S for full browser/desktop automation. However, the code chunk is just a thin local wrapper around an external agent_s.exe binary. It checks whether the binary exists and whether API keys are configured, and then launches the binary with fixed provider/model arguments. Critically, the provided natural-language instruction is not included in the subprocess command, so the wrapper as shown does not actually transmit the requested task to Agent-S. The browse mode only changes a printed/local string. There is also no visible integration with DeepSeek TUI beyond the descriptive claim. While launching Agent-S is related to the stated domain, the implemented behavior is materially less capable than declared and misses the core bridge/control behavior implied by the description.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · agent_s_bridge.py (reported line 26)May include surrounding context.

python

issues.append("agent_s not found. Run: pip install gui-agents")
    
    if not os.environ.get("OPENAI_API_KEY") and not os.environ.get("ANTHROPIC_API_KEY"):
        # Check .env file
        env_file = Path.home() / ".agent-s.env"
        if env_file.exists():
            for line in env_file.read_text().splitlines():

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents shell execution, environment-based secrets, and file access patterns but does not declare any explicit tool scope or permission boundaries. For a bridge that can trigger desktop/browser automation, the absence of declared restrictions increases the chance of overbroad execution and accidental or unsafe agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises natural-language control over the full desktop and browser without warning that it may access files, credentials, logged-in sessions, or perform irreversible system actions. In this context, missing risk disclosure is dangerous because users may issue high-trust commands to an agent with broad GUI control and underestimate the consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The integration guidance encourages passing arbitrary natural-language instructions through shell invocation into a desktop automation bridge, again without warning about destructive, irreversible, or high-impact actions. Because this skill's context is full computer-use automation, the lack of guardrails materially raises the risk of account misuse, file deletion, unintended purchases, or system changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · agent_s_bridge.py (reported line 35)May include surrounding context.

python

else:
                issues.append("No API key found. Set OPENAI_API_KEY or ANTHROPIC_API_KEY in ~/.agent-s.env")
        else:
            issues.append("No API key found. Create ~/.agent-s.env with OPENAI_API_KEY=sk-xxx")
    
    if issues:
        print("Issues found:")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · agent_s_bridge.py (reported line 86)May include surrounding context.

python

print("Press Ctrl+C to stop.\n")
    
    try:
        subprocess.run(cmd, check=True)
    except subprocess.CalledProcessError as e:
        print(f"Agent-S exited with error: {e}")
    except KeyboardInterrupt:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring includes Chinese text ("计算机使用智能体包装器") while the rest of the CLI help and runtime messages are in English. This creates an implicit language choice for users without opt-in or explanation, which matches the locale/language policy concern for natural-language content.

Content

No source excerpt is available for this finding.