Agent Browser Qw

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:23 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent browser automation wrapper, but it deserves review because it combines broad authenticated browser control with unpinned global package installation and lightly documented session persistence.

Review before installing. Use a pinned, trusted version of agent-browser where possible, avoid privileged global installs, and keep saved state files, cookies, screenshots, PDFs, videos, traces, and request logs out of source control and shared directories. Only use saved authenticated sessions for accounts and sites you intend the agent to control.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16
• Finding: Unpinned Third-Party Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md:16-18`; related instruction at `CONTRIBUTING.md:17` **Vulnerability Type**: Unpinned executable dependency and mutable package source **Risk Level**: Medium ### Vulnerable Code `SKILL.md:16-18`: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` `CONTRIBUTING.md:17`: ```bash npm install -g agent-browser@latest ``` ### Technical Analysis The documentation directs users to globally install and execute the current npm registry version of `agent-browser` without pinning an audited version or verifying package integrity. The explicit `@latest` instruction guarantees that the resolved package can change after this Skill has been reviewed. Installing an npm package can execute package-controlled lifecycle scripts. The subsequent `agent-browser install` commands also run code supplied by that mutable dependency and may retrieve or install additional browser and system components. Consequently, trust is transferred from the reviewed Skill package to the current state of an external package publication chain. This is a supply-chain weakness rather than evidence that the current upstream package is malicious. Exploitation requires compromise or malicious control of the package, its maintainer account, or its transitive dependency chain. ### Attack Path 1. An attacker compromises the npm package publication process, a maintainer account, or a dependency used by `agent-browser`. 2. The attacker publishes a malicious release under the package version selected by the unpinned or `@latest` specification. 3. A user follows the documented global installation command. 4. npm downloads the attacker-controlled release and may execute its lifecycle scripts. 5. The user invokes `agent-browser install` or `agent-browser install --with-deps`, executing additional package-controlled installation logic. 6. Malicious code operates ...[truncated 817 chars]
• Remediation: ## Remediation Suggestions 1. Pin `agent-browser` to a specific version that has been reviewed, rather than using an unqualified package name or `@latest`. 2. Record and verify the expected package integrity hash before installation. 3. For source-based installation, pin a reviewed commit hash or signed release tag and use a committed lockfile. 4. Prefer project-local installation over global installation to limit scope and improve reproducibility. 5. Disable npm lifecycle scripts during initial installation where operationally possible, then explicitly run only reviewed setup operations. 6. Perform installation under a non-privileged account and avoid `sudo` or administrator execution. 7. Document all artifacts downloaded by `agent-browser install --with-deps` and provide verification instructions for them. 8. Use automated dependency monitoring and require review before changing the pinned version. 9. Update both `SKILL.md` and `CONTRIBUTING.md` so they consistently reference the same verified version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill documents screenshots, PDFs, and video recording to local files without warning that these artifacts can capture sensitive page contents, tokens, PII, or authenticated data. For an automation skill used by agents, silent file creation materially raises the risk of unintended local persistence and later disclosure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly documents passing HTTP basic-auth credentials on the command line and handling persisted session state/cookies, but provides no warning that these values may be exposed via shell history, process listings, logs, or reused insecurely. In an agent context, this increases the chance that secrets and authenticated session material are stored or echoed without appropriate controls.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 93% confidence
• Finding: The documented ability to save and later load browser state enables persistence of authenticated sessions, cookies, and storage data across runs. Without warnings or constraints, this can lead to credential-equivalent session artifacts being stored insecurely, copied between environments, or reused by unauthorized parties.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 94% confidence
• Finding: The example explicitly encourages saving an authenticated state file and reusing it in later sessions, which normalizes long-lived session persistence without discussing its security implications. In an agent setting, this raises the likelihood of lateral reuse of authenticated browser state and unauthorized access if the file is exposed.

Static analysis

No suspicious patterns detected.