Agent Browser Jt

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:18 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is coherent, but it under-discloses sensitive browser-session handling and recommends broad unpinned installation steps.

Review before installing. Use a pinned reviewed package version where possible, avoid running system dependency installation with elevated privileges unless necessary, and only use auth-state, cookies, and storage commands with authorized test accounts. Treat saved auth state files like credentials: keep them out of source control and logs, restrict access, and delete them when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:197

Finding

Unpinned Global Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 197-199
Vulnerability Type: Unpinned third-party dependency and external component installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

npm install -g agent-browser
agent-browser install                     # Download Chromium
agent-browser install --with-deps         # Linux: + system deps

Technical Analysis

The installation instructions globally install the agent-browser npm package without specifying an exact, reviewed version or verifying its integrity. The installed command is then used to retrieve Chromium and, optionally, install system dependencies.

Because no version pin, lockfile, checksum, signature verification, or immutable artifact reference is provided, the effective package contents can change after this Skill has been reviewed. The metadata links to a GitHub project, but the npm command does not cryptographically bind the downloaded package to that repository or to a specific audited release.

The global installation scope increases potential impact compared with a project-local dependency. In addition, agent-browser install --with-deps may alter operating-system packages and could be run with elevated permissions, depending on the environment. This finding does not establish that the referenced package is malicious; it identifies an avoidable supply-chain exposure caused by unsafe dependency installation guidance.

Attack Path

1. An attacker compromises the npm package publisher account, package registry path, release process, or another component in the distribution chain.
2. The attacker publishes a malicious or backdoored version under the package name used by the unpinned installation command.
3. A user follows the Skill instructions and runs npm install -g agent-browser.
4. npm retrieves the current package version rather than a previously reviewed immutable version.
5. Malicious package files or npm lifecycle scripts execute wit ...[truncated 1082 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin agent-browser to an exact version that has been reviewed, rather than installing the latest available release.
2. Prefer a project-local dependency over a global installation to reduce system-wide exposure.
3. Use a lockfile and npm integrity metadata to make dependency resolution reproducible.
4. Verify package provenance, publisher identity, release signatures, and checksums before installation.
5. Bind documentation to an immutable release or commit and verify that the npm artifact corresponds to the referenced source.
6. Review npm lifecycle scripts and the browser download installer before execution.
7. Download Chromium only from an authenticated, documented source and verify its checksum or signature.
8. Avoid --with-deps unless system dependencies are necessary. Document exactly which packages and privileges it requires.
9. Perform installation in a sandbox, container, or otherwise least-privileged environment without access to production credentials or sensitive browser state.
10. Add dependency monitoring and require a new security review before updating the pinned package or downloaded browser version.

A safer installation example should use a specifically reviewed version:

bash

npm install --save-exact agent-browser@<reviewed-version>
npx agent-browser install

The exact reviewed version and expected artifact integrity values should be supplied by the project maintainers.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs users to save and load browser auth state, which typically includes session cookies and storage tokens, but gives no warning that these files may grant account access if copied, reused, or committed to source control. In an agent-oriented automation context, this is particularly risky because agents may persist artifacts automatically, increasing the chance of credential-like session material being exposed or replayed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documents commands to read and modify cookies and localStorage without any caution that these values can contain session identifiers, authentication material, CSRF-related state, or other sensitive user data. Because this skill is designed for AI agents, normalizing unrestricted access to browser state without warnings increases the likelihood of privacy leaks, account takeover via session reuse, or unintended destructive account actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.