junxuan

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:03 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent browser automation wrapper, but it under-warns about saving reusable login/session data and recommends mutable global installs.

Install only if you are comfortable with an agent controlling browser sessions. Treat saved state files, cookies, storage dumps, recordings, screenshots, PDFs, and uploaded files as sensitive. Prefer a pinned or isolated agent-browser install, avoid running install commands with elevated privileges, and do not save or reuse authenticated session state unless you intentionally need it and can protect and delete it afterward.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15
• Finding: Unpinned Global Installation of an External npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 15–18 **Vulnerability Type**: Supply-chain exposure through an unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` ### Technical Analysis The documented installation procedure globally installs `agent-browser` without specifying an exact audited version. Consequently, the command resolves whichever package version the npm registry currently serves under its default distribution tag. The installed CLI is then executed through `agent-browser install` or `agent-browser install --with-deps`. If a future package release, package-maintainer account, publication pipeline, or transitive dependency is compromised, following these instructions could execute attacker-controlled package lifecycle code or CLI code. Global installation increases the potential scope by placing the executable in the user's global command environment. The `--with-deps` operation can also install browser-related system dependencies and may prompt users to grant elevated privileges, depending on the host platform and upstream implementation. The alternative source installation in `SKILL.md` is similarly not pinned to a reviewed commit or signed release: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build agent-browser install ``` Although the repository URL is consistent with the documented upstream project, cloning the mutable default branch does not ensure that users build the same source revision that was reviewed. ### Attack Path 1. An attacker compromises the npm package maintainer, release pipeline, mutable distribution tag, upstream repository, or a transitive dependency. 2. The attacker publishes or introduces a malicious package version or source revision. 3. A user follows the documented unpinned installation procedure. 4. npm installs ...[truncated 1140 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to an exact reviewed version: ```bash npm install -g agent-browser@X.Y.Z ``` 2. Record and verify npm package integrity and provenance information before installation. 3. Prefer a project-local, lockfile-controlled dependency or an isolated environment over a global installation. 4. Pin source-based installation to a reviewed commit hash or cryptographically verified signed release tag: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout --detach <reviewed-commit-hash> ``` 5. Use a frozen lockfile when installing source dependencies, such as `pnpm install --frozen-lockfile`. 6. Document the exact system changes and privilege requirements of `agent-browser install --with-deps`. 7. Advise users not to grant elevated privileges unless necessary and after reviewing the dependency-installation actions.

T08 · Insecure Dependencies

Warning

• Location: CONTRIBUTING.md:18
• Finding: Recommendation to Install the Mutable Latest npm Release## Vulnerability Details **File Location**: `CONTRIBUTING.md`, lines 18–21 **Vulnerability Type**: Supply-chain exposure through a mutable npm distribution tag **Risk Level**: Medium ### Vulnerable Code Snippet ```bash npm install -g agent-browser@latest ``` ### Technical Analysis The contributor guidance explicitly directs users to install the package referenced by npm's mutable `latest` distribution tag. That tag can be reassigned and does not identify a stable, previously audited artifact. This instruction causes users troubleshooting an issue to replace their existing global installation with whichever release is current at execution time. If the package publication process or maintainer account is compromised, the guidance provides a direct path for delivering and executing the compromised package. npm lifecycle scripts may execute during installation, before the user invokes the CLI. ### Attack Path 1. An attacker gains control of the package publication channel or compromises a release dependency. 2. The attacker publishes a malicious release and associates it with the `latest` tag. 3. A contributor follows the issue-reporting prerequisite and executes the documented command. 4. npm retrieves the attacker-controlled package and installs it globally. 5. Installation lifecycle code or a subsequent CLI invocation executes the payload with the contributor's user privileges. 6. The globally installed executable remains available to later shell sessions until removed or replaced. ### Impact Assessment Exploitation can result in arbitrary code execution with the privileges of the user performing the installation. The malicious package could read or alter user-accessible files, collect environment-based credentials, modify user-level configuration, or replace the globally available CLI. The instruction does not itself request administrative privileges, so system-wide compromise is not guaranteed. Impact becomes broader if the command is run from an e ...[truncated 88 chars]
• Remediation: ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed version: ```bash npm install -g agent-browser@X.Y.Z ``` 2. State the expected package version and integrity or provenance details in the contribution guide. 3. Require verification against a signed release or trusted checksum before installation. 4. Prefer an isolated or project-local installation rather than modifying the user's global executable environment. 5. Treat updating to a newer release as an explicit, reviewed troubleshooting step rather than a mandatory prerequisite. 6. Warn contributors against running package installation from an elevated shell unless strictly required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly documents file upload, screenshots/PDF output, and session-state save/load capabilities but does not warn that these operations can read from or persist sensitive local data such as documents, screenshots, cookies, or authentication tokens. In an agent context, omission of these safeguards increases the chance that an agent will exfiltrate or leave behind sensitive artifacts on disk without user awareness.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The recording feature states that cookies/storage are preserved, and the skill also documents saving and loading auth state, but it provides no warning that these artifacts may contain reusable credentials or session tokens. This is dangerous because an agent or downstream user may unknowingly persist authenticated session material and replay it later, enabling account compromise or privacy leakage if the files are accessed by others.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 94% confidence
• Finding: The documented ability to save and later load browser session state creates a persistence mechanism for cookies, local storage, and possibly authenticated state. In an agent skill, that materially increases the risk of credential reuse, cross-task data leakage, and unauthorized access if state files are retained, shared, or loaded in the wrong context.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 95% confidence
• Finding: The example workflow normalizes saving login state after authentication and reloading it in later sessions without discussing security boundaries. That makes risky persistence feel routine and may lead users or agents to store reusable authenticated sessions in plain files, which can be stolen or misapplied to impersonate the user.

Vague Triggers

Low

• Confidence: 76% confidence
• Finding: In this markdown file, the phrase "You need help using the CLI with this skill wrapper" is broad enough to overlap with common support requests and does not clearly define when a repository issue should be opened versus when other support channels should be used. The surrounding section gives examples, but it does not provide explicit exclusions or tighter trigger boundaries for this case.

Static analysis

No suspicious patterns detected.