ClawHub
Back to skill

Security audit

Agent Browser

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent browser-automation skill, but users should treat saved browser state as sensitive and avoid unpinned global installs when possible.

Install from a pinned, trusted agent-browser version when possible, avoid running installation as root/admin, and keep saved auth.json, screenshots, PDFs, videos, and traces out of repositories or shared folders because they may contain cookies, tokens, credentials, or private page data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Global npm Package and Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-26
Vulnerability Type: Unpinned third-party dependencies and unverified installation artifacts
Risk Level: Medium

Vulnerable Code

bash
npm install -g agent-browser
agent-browser install
agent-browser install --with-deps
bash
git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
pnpm install
pnpm build
agent-browser install

Technical Analysis

The installation instructions resolve mutable upstream content without specifying an audited npm package version, Git commit, lockfile state, or artifact integrity hash. The npm command installs the package globally, while the source-based method clones the repository's current default branch. Both approaches can therefore retrieve code that differs from the version reviewed during this audit.

npm package installation can invoke package lifecycle scripts. The subsequent agent-browser install and agent-browser install --with-deps commands may also download browser components or install system dependencies. Consequently, compromise of the package, repository, maintainer account, release infrastructure, or a transitive dependency could cause attacker-controlled code to execute during installation.

The referenced GitHub repository is consistent with the documented browser CLI, and no evidence of an intentionally malicious or spoofed package was found in the audited files. The vulnerability is the absence of version pinning and integrity controls.

Attack Path

  1. An attacker compromises the upstream npm package, source repository, maintainer account, release channel, or a transitive dependency.
  2. The attacker publishes malicious content under the existing package name or modifies the repository's default branch.
  3. A user follows the documented unpinned installation commands.
  4. npm, Git, or the CLI installation process retrieves the mutable malicious c ...[truncated 938 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin agent-browser to a specifically reviewed version, for example agent-browser@X.Y.Z, rather than resolving the current release.
  2. Pin source installations to a verified commit hash or signed release tag instead of cloning and building the repository's mutable default branch.
  3. Publish and verify expected integrity hashes for downloaded packages, browser binaries, and other installation artifacts.
  4. Use a committed lockfile with immutable or frozen-lockfile installation for source builds, and review all dependency changes before updating it.
  5. Prefer a project-local installation over a global installation so that the executable is isolated and version-controlled.
  6. Run installation under a dedicated, unprivileged account or sandbox. Avoid administrator or root privileges unless a separately reviewed system dependency genuinely requires them.
  7. Separate browser download and operating-system dependency installation into documented, auditable steps rather than relying on a broad --with-deps operation.
  8. Verify npm provenance, release signatures, repository ownership, and package maintainer changes before accepting upgrades.

T08 · Insecure Dependencies

Warning
Location
CONTRIBUTING.md:14
Finding

Contributor Instructions Require Installation of the Mutable Latest Package Release

Content
View full analysis

Vulnerability Details

File Location: CONTRIBUTING.md, lines 14-17
Vulnerability Type: Explicit installation of an unpinned latest dependency
Risk Level: Medium

Vulnerable Code

markdown
1. Install the latest version
   ```bash
   npm install -g agent-browser@latest
   ```

Technical Analysis

The contributor workflow explicitly installs agent-browser@latest. The latest npm distribution tag is mutable and can be reassigned to a different release after this skill has been reviewed. The instructions do not require package-integrity verification, provenance validation, or review of the resolved package and its transitive dependencies.

A global npm installation may execute package lifecycle scripts and places the resulting executable in a shared command location. Therefore, a malicious or compromised release assigned to the latest tag could execute during installation and persist as the command used in subsequent testing. No evidence that the currently referenced package is malicious was present in the audited project; the risk arises from trusting mutable future releases without verification.

Attack Path

  1. An attacker compromises the npm publisher account, package release process, or a dependency included by a future release.
  2. A malicious package version is published and assigned to the mutable latest tag.
  3. A contributor follows the issue-reporting instructions and runs the global npm installation command.
  4. npm downloads the attacker-controlled release and may execute its lifecycle scripts.
  5. The malicious package obtains the contributor account's privileges and installs or replaces the globally available CLI.
  6. Later tests invoke the compromised executable under the expected agent-browser command name.

Impact Assessment

Exploitation could result in arbitrary code execution as the contributor account, access to files and environment variables available to tha ...[truncated 296 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace agent-browser@latest with a specific, reviewed version.
  2. Document the expected package integrity value and require verification before installation.
  3. Prefer a local development dependency invoked through the package manager rather than a global installation.
  4. Require review of release notes, package provenance, maintainer changes, and transitive dependency changes before updating the pinned version.
  5. Test upgrades in an isolated container or sandbox with no production credentials or sensitive browser state.
  6. Avoid running npm with administrator or root privileges and disable unnecessary lifecycle scripts where compatible with the package's documented installation process.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly documents saving and loading authenticated browser state without any warning that auth.json may contain cookies, tokens, or other session material. In an agent context, this can normalize insecure storage and reuse of sensitive credentials, enabling account takeover if the file is exposed, reused across tasks, or committed to disk unintentionally.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The documented state save/load feature enables persistence and replay of authenticated browser sessions. Without safeguards or warnings, an agent or user may store reusable session material on disk, making hijacking or lateral reuse possible if the file is accessed by other processes, users, or future tasks.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The example workflow normalizes logging in once and reusing saved authenticated state later, but omits any caution about the security consequences of persisting auth.json. In an agent setting, this makes session replay especially risky because subsequent automated tasks may inherit privileged access without fresh authentication or user awareness.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill advertises writing screenshots, PDFs, videos, traces, and session artifacts to local files but does not warn that these outputs persist and may capture sensitive page contents, tokens, PII, or internal application data. In agent-driven workflows, silent artifact creation increases the chance of unintended retention or disclosure of sensitive information.

Content

No source excerpt is available for this finding.