ClawHub
Back to skill

Security audit

Agent Browser Qw

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent browser automation wrapper, but it deserves review because it combines broad authenticated browser control with unpinned global package installation and lightly documented session persistence.

Review before installing. Use a pinned, trusted version of agent-browser where possible, avoid privileged global installs, and keep saved state files, cookies, screenshots, PDFs, videos, traces, and request logs out of source control and shared directories. Only use saved authenticated sessions for accounts and sites you intend the agent to control.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Unpinned Third-Party Package Installation and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16-18; related instruction at CONTRIBUTING.md:17
Vulnerability Type: Unpinned executable dependency and mutable package source
Risk Level: Medium

Vulnerable Code

SKILL.md:16-18:

bash
npm install -g agent-browser
agent-browser install
agent-browser install --with-deps

CONTRIBUTING.md:17:

bash
npm install -g agent-browser@latest

Technical Analysis

The documentation directs users to globally install and execute the current npm registry version of agent-browser without pinning an audited version or verifying package integrity. The explicit @latest instruction guarantees that the resolved package can change after this Skill has been reviewed.

Installing an npm package can execute package-controlled lifecycle scripts. The subsequent agent-browser install commands also run code supplied by that mutable dependency and may retrieve or install additional browser and system components. Consequently, trust is transferred from the reviewed Skill package to the current state of an external package publication chain.

This is a supply-chain weakness rather than evidence that the current upstream package is malicious. Exploitation requires compromise or malicious control of the package, its maintainer account, or its transitive dependency chain.

Attack Path

  1. An attacker compromises the npm package publication process, a maintainer account, or a dependency used by agent-browser.
  2. The attacker publishes a malicious release under the package version selected by the unpinned or @latest specification.
  3. A user follows the documented global installation command.
  4. npm downloads the attacker-controlled release and may execute its lifecycle scripts.
  5. The user invokes agent-browser install or agent-browser install --with-deps, executing additional package-controlled installation logic.
  6. Malicious code operates ...[truncated 817 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin agent-browser to a specific version that has been reviewed, rather than using an unqualified package name or @latest.
  2. Record and verify the expected package integrity hash before installation.
  3. For source-based installation, pin a reviewed commit hash or signed release tag and use a committed lockfile.
  4. Prefer project-local installation over global installation to limit scope and improve reproducibility.
  5. Disable npm lifecycle scripts during initial installation where operationally possible, then explicitly run only reviewed setup operations.
  6. Perform installation under a non-privileged account and avoid sudo or administrator execution.
  7. Document all artifacts downloaded by agent-browser install --with-deps and provide verification instructions for them.
  8. Use automated dependency monitoring and require review before changing the pinned version.
  9. Update both SKILL.md and CONTRIBUTING.md so they consistently reference the same verified version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill documents screenshots, PDFs, and video recording to local files without warning that these artifacts can capture sensitive page contents, tokens, PII, or authenticated data. For an automation skill used by agents, silent file creation materially raises the risk of unintended local persistence and later disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly documents passing HTTP basic-auth credentials on the command line and handling persisted session state/cookies, but provides no warning that these values may be exposed via shell history, process listings, logs, or reused insecurely. In an agent context, this increases the chance that secrets and authenticated session material are stored or echoed without appropriate controls.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The documented ability to save and later load browser state enables persistence of authenticated sessions, cookies, and storage data across runs. Without warnings or constraints, this can lead to credential-equivalent session artifacts being stored insecurely, copied between environments, or reused by unauthorized parties.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The example explicitly encourages saving an authenticated state file and reusing it in later sessions, which normalizes long-lived session persistence without discussing its security implications. In an agent setting, this raises the likelihood of lateral reuse of authenticated browser state and unauthorized access if the file is exposed.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text