T08 · Insecure Dependencies
Warning
- Location
SKILL.md:4- Finding
Unpinned third-party browser package execution
- Content
View full analysis
- Remediation
View remediation
Security audit
test safe agent-browser
Security checks for vulnerabilities and agentic risk
Overview
This skill is a powerful browser automation wrapper presented as restricted and safe, but its documented defaults and templates allow broad navigation, authentication, session persistence, file access, and page scripting without enforced guardrails.
Review this as a high-trust browser automation skill, not a read-only browser helper. Install only if you are comfortable with an unpinned npm tool controlling browser sessions, interacting with authenticated sites, saving cookies/session data, writing capture files, and running page JavaScript; use strict domain allowlists, content boundaries, output limits, a pinned package version, encrypted state, and avoid reusing saved auth state unless explicitly needed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:10- Finding
Mandatory browser safety controls are documented but not enforced
- Content
View full analysis
}" echo "Form automation: $FORM_URL" # Step 1: Navigate to form agent-browser open "$FORM_URL" agent-browser wait --load networkidle ``` ```bash TARGET_URL="${1:?Usage: $0 [output-dir]}" OUTPUT_DIR="${2:-.}" echo "Capturing: $TARGET_URL" mkdir -p "$OUTPUT_DIR" # Navigate to target agent-browser open "$TARGET_URL" agent-browser wait --load networkidle ``` ```bash LOGIN_URL="${1:?Usage: $0 [state-file]}" STATE_FILE="${2:-./auth-state.json}" echo "Authentication workflow: $LOGIN_URL" ... agent-browser open "$LOGIN_URL" agent-browser wait --load networkidle ``` ### Technical Analysis The repository includes a restrictive `policy.json`, but the policy is inactive unless `AGENT_BROWSER_ACTION_POLICY` points to it. None of the ready-to-use templates activates that policy or verifies that the variable is already set. Likewise, the templates do not enforce content-boundary markers, output limits, or a domain allowlist. They accept arbitrary URL arguments and pass them directly to the browser. This conflicts with the Skill's claim that hardened operation is mandatory and caus ...[truncated 1427 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
templates/authenticated-session.sh:28- Finding
Caller-controlled state path can cause arbitrary file deletion
- Content
View full analysis
[state-file]}" STATE_FILE="${2:-./auth-state.json}" echo "Authentication workflow: $LOGIN_URL" # ================================================================ # SAVED STATE: Skip login if valid saved state exists # ================================================================ if [[ -f "$STATE_FILE" ]]; then echo "Loading saved state from $STATE_FILE..." if agent-browser --state "$STATE_FILE" open "$LOGIN_URL" 2>/dev/null; then agent-browser wait --load networkidle CURRENT_URL=$(agent-browser get url) if [[ "$CURRENT_URL" != *"login"* ]] && [[ "$CURRENT_URL" != *"signin"* ]]; then echo "Session restored successfully" agent-browser snapshot -i exit 0 fi echo "Session expired, performing fresh login..." agent-browser close 2>/dev/null || true else echo "Failed to load state, re-authenticating..." fi rm -f "$STATE_FILE" fi ``` ### Technical Analysis The second positional argument completely controls `STATE_FILE`. The script checks only whether the path refers to a regular file. If state loading fails, or if the resulting URL appears to be a login page, the script unconditionally executes `rm -f "$STATE_FILE"`. There is no canonical-path validation, ownership check, dedicated state directory, expected file-format verification before deletion, or proof that the script originally created the target. Shell quoting prevents command injection, but it does not prevent deletion of an unintended file. ### Attack Path 1. The script is invoked with the path of an existing user-writable file as its second argument. 2. The file satisfies `[[ -f "$STATE_FILE" ]]`. 3. The browser cannot load it a ...[truncated 516 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
templates/authenticated-session.sh:29- Finding
Authentication state is persisted without enforced confidentiality or safe temporary-file handling
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/proxy-support.md:40- Finding
Proxy examples expose credentials and permit TLS verification bypass
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (48)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is presented as restricted navigation, screenshots, and public-data extraction, but it also supports interactive state-changing actions such as form filling, clicking, and submission. That discrepancy increases the chance of unintended writes, account changes, or other destructive browser-side actions under a falsely narrow safety label.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is presented as restricted navigation, screenshots, and public-data extraction, but it also supports interactive state-changing actions such as form filling, clicking, and submission. That discrepancy increases the chance of unintended writes, account changes, or other destructive browser-side actions under a falsely narrow safety label.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file says execution is forbidden without safety boundaries, but later admits that all security features are opt-in and unrestricted behavior is the default. This contradiction is dangerous because users may rely on the earlier assurance while the actual runtime defaults permit unsafe navigation, output, and action behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill claims to be restricted, yet it exposes capabilities such as credential vaulting, authenticated login, persistent state storage, downloads, local file interaction, proxy support, and arbitrary JavaScript evaluation. This is a broad privilege surface that can access sensitive data, alter sessions, and create local artifacts beyond the stated purpose.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation encourages saving authentication state to disk but does not clearly warn that the saved state can include sensitive cookies, bearer tokens, and session identifiers. If those files are exposed, copied, or reused improperly, an attacker could hijack authenticated sessions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Auto-saved session persistence retains cookies and localStorage across runs without a prominent warning about the sensitivity of that data. Persistent browser state can silently carry authentication across tasks, increasing the risk of cross-task data leakage, unauthorized reuse, or session theft.
- Content
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
Session recording can capture credentials, tokens, personal data, and other sensitive page contents visible during browsing. In this skill, recording is normalized as a debugging feature without guardrails, so artifacts like
.webmfiles may become durable context leaks if stored or shared.- Content
bash agent-browser --headed open https://example.com agent-browser highlight @e1 # Highlight element agent-browser record start demo.webm # Record session agent-browser profiler start # Start Chrome DevTools profiling agent-browser profiler stop trace.json # Stop and save profile (path optional)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Allowing
file://access exposes local filesystem contents to the browser automation flow, yet the section lacks a strong warning about that risk. In an agent setting, this can bridge web automation into local file disclosure, especially if combined with extraction, screenshots, or script execution.- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file documents login flows, session persistence, OAuth, 2FA, cookies, and credential handling even though the skill is described as a restricted browser for navigation, screenshots, public-data extraction, and testing. This expands the effective capability boundary into authenticated-session handling, which can enable account access, token capture, and reuse of privileged browser state beyond the declared safe scope.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The examples directly handle usernames, passwords, auth cookies, HTTP Basic credentials, and persistent state files. In a supposedly restricted 'safe' browser skill, this materially increases risk by normalizing storage and replay of live authentication artifacts that could be abused for unauthorized access or lateral movement if exposed.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
-
Clean up after automation
bash agent-browser cookies clear rm -f ./auth-state.json -
Use short-lived sessions for CI/CD
-
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation presents the tool as restricted and safe, yet the reference exposes broad code execution, persistence, authentication, and state-changing features. This mismatch is dangerous because operators and downstream agents may rely on the safety framing while unknowingly invoking much more powerful capabilities.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The command reference includes request interception and response mocking features that materially exceed a 'restricted browser automation' tool intended only for navigation, screenshots, and public-data extraction. These capabilities can alter application behavior, bypass intended workflows, and facilitate unauthorized testing or manipulation if exposed to an agent without strong policy enforcement.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented support for credentials, cookies, localStorage manipulation, and request routing expands the tool from passive browsing into persistent authenticated session control and browser state modification. In the context of a supposedly limited safe browser skill, this creates a path to retain secrets, impersonate users, and alter execution context beyond public-data extraction.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Arbitrary JavaScript execution via eval, base64 input, or stdin directly contradicts the skill's stated safety-bounded purpose. It enables inspection and modification of page state, extraction of sensitive DOM data, and execution of complex logic that bypasses higher-level safety constraints normally imposed by limited browser commands.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
echo "*.auth-state.json" >> .gitignore
Delete after use
rm /tmp/auth-state.json
text ### 4. Timeout Long Sessions
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The template explicitly supports authenticated login and session reuse, which expands the skill beyond its declared restricted browsing scope of navigation, screenshots, public data extraction, and testing. Even though much of the actual login flow is commented out, the file is a ready-made workflow for handling authenticated access and persistent session state, creating a capability/policy mismatch that can enable access to non-public data.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The template introduces credential ingestion via environment variables and persistent authenticated state storage, neither of which is necessary for a tool described as limited to public-data browsing and testing. This increases the risk of credential misuse, accidental secret exposure, and unauthorized replay of authenticated sessions through the saved state file.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The template enables active form filling, submission, and post-submit verification, which exceeds the stated skill scope of navigation, screenshots, extraction of public data, and testing under constrained boundaries. In practice, this can be used to perform unauthorized actions on third-party sites, submit sensitive data, or drive workflows that materially change remote state, making the mismatch between declared purpose and actual capability security-relevant.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Including a file upload example introduces a path for local file exfiltration or accidental disclosure of sensitive host data, especially if operators reuse the template without understanding the trust boundary. Because the skill's stated purpose does not justify local file access, this capability is unusually dangerous in context and can be abused to transmit arbitrary files to remote forms.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The skill allows execution via
npx agent-browser:*without pinning a specific package version. That creates supply-chain risk because future package updates or a compromised upstream release could change behavior or introduce malicious code while retaining the same invocation path.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Early text frames snapshots as a way to avoid reading sensitive full-page content, but later sections document unrestricted full-page text extraction and arbitrary JS execution in the browser context. This inconsistency can cause operators to underestimate the amount of untrusted or sensitive content the skill can ingest and expose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The download and file output examples write artifacts to the local filesystem without clearly warning about that side effect. This can lead to unreviewed persistence of untrusted files, storage of sensitive content, or accidental overwriting/exfiltration paths in agent workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example
get text body > page.txtwrites full-page contents to disk without warning that the page may contain secrets, personal data, or copyrighted material. In a browser automation context, this can create unexpected local data residues and broaden exposure beyond the live browsing session.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
Persistent configuration and profile storage can retain browsing data, cookies, history, and other state across runs. In a supposedly restricted browser skill, this increases cross-task contamination risk and can preserve sensitive state longer than users expect.
- Content
Configuration File
Create
agent-browser.jsonin the project root for persistent settings:json {