ClawHub
Back to skill

Security audit

Agent Browser Jau771

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill appears legitimate, but it gives agents broad browser and session control without enough safety framing, so users should review it before installing.

Install only if you need full browser automation, not just simple page viewing. Use test accounts where possible, avoid attaching to a personal live browser through CDP, approve any uploads and saved screenshots/PDFs/videos explicitly, and protect or delete saved state files such as auth.json because they may contain session credentials. Prefer a pinned reviewed package version or commit, and avoid running the install commands with administrator privileges.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Third-Party CLI Installation and Execution

Content
View full analysis
Remediation
View remediation
``` 2. Pin source installations to a verified immutable commit or signed release tag: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout ``` 3. Publish the expected commit SHA and cryptographic checksums for release artifacts and browser binaries. Verify them before installation or execution. 4. Enforce a committed lockfile with frozen dependency resolution, such as `pnpm install --frozen-lockfile`. 5. Prefer signed releases and document signature verification procedures. 6. Avoid global installation where practical. Use a project-local dependency, isolated container, or dedicated unprivileged account. 7. Explicitly warn users not to run npm, pnpm, or `agent-browser install --with-deps` with administrative privileges unless required and independently reviewed. 8. Review npm lifecycle scripts, build scripts, transitive dependencies, and binary-download behavior before updating the pinned version. 9. Establish a controlled upgrade process in which new versions are reviewed, tested, and assigned updated checksums before documentation is changed. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description narrows the skill to navigation, clicking, typing, and snapshots, but the body documents materially broader capabilities including JavaScript execution, CDP attachment, cookie/storage inspection, request interception, credential/header setting, file upload, state persistence, screenshots/PDF output, and recording. Understating scope can cause downstream agents or reviewers to grant the skill in contexts where these higher-risk capabilities were not expected, weakening informed consent and tool governance.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill supports saving screenshots/PDFs to local files and uploading local files into web pages, but it does not warn that these operations can write sensitive page contents to disk or transfer local files to remote services. In an agent setting, this increases risk of unintended data exfiltration or creation of residual artifacts containing private information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents recording, saved session state, cookies/localStorage access, custom headers, and credential handling without any privacy or secret-management warning. These features can expose authentication material and browsing data, and in combination make it easy to persist, replay, or leak sensitive session information across runs or to remote sites.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

Saving and loading browser state enables session persistence, which is useful but security-relevant because state files may contain authenticated cookies, tokens, or other session artifacts. In an agent context, persisted auth can be replayed later by other tasks or users if stored insecurely, effectively extending access beyond the original authorization window.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The authentication example normalizes saving auth.json after login and reusing it later, which operationally encourages persistence of live authenticated sessions. Without warnings or guardrails, users and agents may treat these files casually, increasing the chance of credential/session theft or unauthorized reuse.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The documented --cdp option enables attaching to an existing Chrome DevTools Protocol endpoint, which can expose a much more privileged browser/session than the isolated automation context implied by the skill description. If an agent connects to a user’s live browser or another process’ debugging port, it may access authenticated pages, cookies, storage, tabs, and sensitive content without clear scoping or warning.

Content

No source excerpt is available for this finding.