Agent Browser

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:07 AM UTC
• Version: 1.0.0

Overview

This is a coherent browser-automation skill, but users should treat saved browser state as sensitive and avoid unpinned global installs when possible.

Install from a pinned, trusted agent-browser version when possible, avoid running installation as root/admin, and keep saved auth.json, screenshots, PDFs, videos, and traces out of repositories or shared folders because they may contain cookies, tokens, credentials, or private page data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned Global npm Package and Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 17-26 **Vulnerability Type**: Unpinned third-party dependencies and unverified installation artifacts **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build agent-browser install ``` ### Technical Analysis The installation instructions resolve mutable upstream content without specifying an audited npm package version, Git commit, lockfile state, or artifact integrity hash. The npm command installs the package globally, while the source-based method clones the repository's current default branch. Both approaches can therefore retrieve code that differs from the version reviewed during this audit. npm package installation can invoke package lifecycle scripts. The subsequent `agent-browser install` and `agent-browser install --with-deps` commands may also download browser components or install system dependencies. Consequently, compromise of the package, repository, maintainer account, release infrastructure, or a transitive dependency could cause attacker-controlled code to execute during installation. The referenced GitHub repository is consistent with the documented browser CLI, and no evidence of an intentionally malicious or spoofed package was found in the audited files. The vulnerability is the absence of version pinning and integrity controls. ### Attack Path 1. An attacker compromises the upstream npm package, source repository, maintainer account, release channel, or a transitive dependency. 2. The attacker publishes malicious content under the existing package name or modifies the repository's default branch. 3. A user follows the documented unpinned installation commands. 4. npm, Git, or the CLI installation process retrieves the mutable malicious c ...[truncated 938 chars]
• Remediation: ## Remediation Suggestions 1. Pin `agent-browser` to a specifically reviewed version, for example `agent-browser@X.Y.Z`, rather than resolving the current release. 2. Pin source installations to a verified commit hash or signed release tag instead of cloning and building the repository's mutable default branch. 3. Publish and verify expected integrity hashes for downloaded packages, browser binaries, and other installation artifacts. 4. Use a committed lockfile with immutable or frozen-lockfile installation for source builds, and review all dependency changes before updating it. 5. Prefer a project-local installation over a global installation so that the executable is isolated and version-controlled. 6. Run installation under a dedicated, unprivileged account or sandbox. Avoid administrator or root privileges unless a separately reviewed system dependency genuinely requires them. 7. Separate browser download and operating-system dependency installation into documented, auditable steps rather than relying on a broad `--with-deps` operation. 8. Verify npm provenance, release signatures, repository ownership, and package maintainer changes before accepting upgrades.

T08 · Insecure Dependencies

Warning

• Location: CONTRIBUTING.md:14
• Finding: Contributor Instructions Require Installation of the Mutable Latest Package Release## Vulnerability Details **File Location**: `CONTRIBUTING.md`, lines 14-17 **Vulnerability Type**: Explicit installation of an unpinned latest dependency **Risk Level**: Medium ### Vulnerable Code ```markdown 1. Install the latest version ```bash npm install -g agent-browser@latest ``` ``` ### Technical Analysis The contributor workflow explicitly installs `agent-browser@latest`. The `latest` npm distribution tag is mutable and can be reassigned to a different release after this skill has been reviewed. The instructions do not require package-integrity verification, provenance validation, or review of the resolved package and its transitive dependencies. A global npm installation may execute package lifecycle scripts and places the resulting executable in a shared command location. Therefore, a malicious or compromised release assigned to the `latest` tag could execute during installation and persist as the command used in subsequent testing. No evidence that the currently referenced package is malicious was present in the audited project; the risk arises from trusting mutable future releases without verification. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or a dependency included by a future release. 2. A malicious package version is published and assigned to the mutable `latest` tag. 3. A contributor follows the issue-reporting instructions and runs the global npm installation command. 4. npm downloads the attacker-controlled release and may execute its lifecycle scripts. 5. The malicious package obtains the contributor account's privileges and installs or replaces the globally available CLI. 6. Later tests invoke the compromised executable under the expected `agent-browser` command name. ### Impact Assessment Exploitation could result in arbitrary code execution as the contributor account, access to files and environment variables available to tha ...[truncated 296 chars]
• Remediation: ## Remediation Suggestions 1. Replace `agent-browser@latest` with a specific, reviewed version. 2. Document the expected package integrity value and require verification before installation. 3. Prefer a local development dependency invoked through the package manager rather than a global installation. 4. Require review of release notes, package provenance, maintainer changes, and transitive dependency changes before updating the pinned version. 5. Test upgrades in an isolated container or sandbox with no production credentials or sensitive browser state. 6. Avoid running npm with administrator or root privileges and disable unnecessary lifecycle scripts where compatible with the package's documented installation process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly documents saving and loading authenticated browser state without any warning that auth.json may contain cookies, tokens, or other session material. In an agent context, this can normalize insecure storage and reuse of sensitive credentials, enabling account takeover if the file is exposed, reused across tasks, or committed to disk unintentionally.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 91% confidence
• Finding: The documented state save/load feature enables persistence and replay of authenticated browser sessions. Without safeguards or warnings, an agent or user may store reusable session material on disk, making hijacking or lateral reuse possible if the file is accessed by other processes, users, or future tasks.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 93% confidence
• Finding: The example workflow normalizes logging in once and reusing saved authenticated state later, but omits any caution about the security consequences of persisting auth.json. In an agent setting, this makes session replay especially risky because subsequent automated tasks may inherit privileged access without fresh authentication or user awareness.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The skill advertises writing screenshots, PDFs, videos, traces, and session artifacts to local files but does not warn that these outputs persist and may capture sensitive page contents, tokens, PII, or internal application data. In agent-driven workflows, silent artifact creation increases the chance of unintended retention or disclosure of sensitive information.

Static analysis

No suspicious patterns detected.