T08 · Insecure Dependencies
Warning
- Location
SKILL.md:127- Finding
Unpinned Global Installation of a Third-Party npm Package
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Browser CLI
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed browser automation helper, but it asks users to install a mutable global CLI and encourages account-impacting automated actions without clear safeguards.
Review this carefully before installing. Use it only in a limited environment, avoid sensitive browser profiles and stored sessions, do not paste real passwords into scripts, confirm every submission or account-changing click, and prefer a pinned or isolated local installation of agent-browser rather than a global latest-version install.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger description is broad enough to activate on common browsing, scraping, and web interaction requests, which can cause the agent to invoke powerful browser automation in situations where simpler or safer capabilities would suffice. In this skill’s context, broad routing is more dangerous because the tool can navigate sites, click controls, and extract content, increasing the chance of unintended automation on sensitive pages or against user accounts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill provides sign-in, form-filling, and scheduled check-in workflows without prominent safeguards about credential handling, consent, irreversible submissions, or account-impacting actions. This is dangerous because it normalizes automated interactions that may submit data, trigger account changes, or repeatedly act on behalf of a user, especially when combined with cron-based unattended execution.
- Content
Static analysis
No suspicious patterns detected.