junxuan

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:03 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent browser automation wrapper, but it under-warns about saving reusable login/session data and recommends mutable global installs.

Install only if you are comfortable with an agent controlling browser sessions. Treat saved state files, cookies, storage dumps, recordings, screenshots, PDFs, and uploaded files as sensitive. Prefer a pinned or isolated agent-browser install, avoid running install commands with elevated privileges, and do not save or reuse authenticated session state unless you intentionally need it and can protect and delete it afterward.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Global Installation of an External npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–18
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippet

bash

npm install -g agent-browser
agent-browser install
agent-browser install --with-deps

Technical Analysis

The documented installation procedure globally installs agent-browser without specifying an exact audited version. Consequently, the command resolves whichever package version the npm registry currently serves under its default distribution tag.

The installed CLI is then executed through agent-browser install or agent-browser install --with-deps. If a future package release, package-maintainer account, publication pipeline, or transitive dependency is compromised, following these instructions could execute attacker-controlled package lifecycle code or CLI code.

Global installation increases the potential scope by placing the executable in the user's global command environment. The --with-deps operation can also install browser-related system dependencies and may prompt users to grant elevated privileges, depending on the host platform and upstream implementation.

The alternative source installation in SKILL.md is similarly not pinned to a reviewed commit or signed release:

bash

git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
pnpm install
pnpm build
agent-browser install

Although the repository URL is consistent with the documented upstream project, cloning the mutable default branch does not ensure that users build the same source revision that was reviewed.

Attack Path

1. An attacker compromises the npm package maintainer, release pipeline, mutable distribution tag, upstream repository, or a transitive dependency.
2. The attacker publishes or introduces a malicious package version or source revision.
3. A user follows the documented unpinned installation procedure.
4. npm installs ...[truncated 1140 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version:

   bash

   npm install -g agent-browser@X.Y.Z
   

2. Record and verify npm package integrity and provenance information before installation.

3. Prefer a project-local, lockfile-controlled dependency or an isolated environment over a global installation.

4. Pin source-based installation to a reviewed commit hash or cryptographically verified signed release tag:

   bash

   git clone https://github.com/vercel-labs/agent-browser
   cd agent-browser
   git checkout --detach <reviewed-commit-hash>
   

5. Use a frozen lockfile when installing source dependencies, such as pnpm install --frozen-lockfile.

6. Document the exact system changes and privilege requirements of agent-browser install --with-deps.

7. Advise users not to grant elevated privileges unless necessary and after reviewing the dependency-installation actions.

T08 · Insecure Dependencies

Warning

• Location: CONTRIBUTING.md:18

Finding

Recommendation to Install the Mutable Latest npm Release

Content

View full analysis

Vulnerability Details

File Location: CONTRIBUTING.md, lines 18–21
Vulnerability Type: Supply-chain exposure through a mutable npm distribution tag
Risk Level: Medium

Vulnerable Code Snippet

bash

npm install -g agent-browser@latest

Technical Analysis

The contributor guidance explicitly directs users to install the package referenced by npm's mutable latest distribution tag. That tag can be reassigned and does not identify a stable, previously audited artifact.

This instruction causes users troubleshooting an issue to replace their existing global installation with whichever release is current at execution time. If the package publication process or maintainer account is compromised, the guidance provides a direct path for delivering and executing the compromised package. npm lifecycle scripts may execute during installation, before the user invokes the CLI.

Attack Path

1. An attacker gains control of the package publication channel or compromises a release dependency.
2. The attacker publishes a malicious release and associates it with the latest tag.
3. A contributor follows the issue-reporting prerequisite and executes the documented command.
4. npm retrieves the attacker-controlled package and installs it globally.
5. Installation lifecycle code or a subsequent CLI invocation executes the payload with the contributor's user privileges.
6. The globally installed executable remains available to later shell sessions until removed or replaced.

Impact Assessment

Exploitation can result in arbitrary code execution with the privileges of the user performing the installation. The malicious package could read or alter user-accessible files, collect environment-based credentials, modify user-level configuration, or replace the globally available CLI.

The instruction does not itself request administrative privileges, so system-wide compromise is not guaranteed. Impact becomes broader if the command is run from an e ...[truncated 88 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed version:

   bash

   npm install -g agent-browser@X.Y.Z
   

2. State the expected package version and integrity or provenance details in the contribution guide.

3. Require verification against a signed release or trusted checksum before installation.

4. Prefer an isolated or project-local installation rather than modifying the user's global executable environment.

5. Treat updating to a newer release as an explicit, reviewed troubleshooting step rather than a mandatory prerequisite.

6. Warn contributors against running package installation from an elevated shell unless strictly required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly documents file upload, screenshots/PDF output, and session-state save/load capabilities but does not warn that these operations can read from or persist sensitive local data such as documents, screenshots, cookies, or authentication tokens. In an agent context, omission of these safeguards increases the chance that an agent will exfiltrate or leave behind sensitive artifacts on disk without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The recording feature states that cookies/storage are preserved, and the skill also documents saving and loading auth state, but it provides no warning that these artifacts may contain reusable credentials or session tokens. This is dangerous because an agent or downstream user may unknowingly persist authenticated session material and replay it later, enabling account compromise or privacy leakage if the files are accessed by others.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The documented ability to save and later load browser session state creates a persistence mechanism for cookies, local storage, and possibly authenticated state. In an agent skill, that materially increases the risk of credential reuse, cross-task data leakage, and unauthorized access if state files are retained, shared, or loaded in the wrong context.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash

agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The example workflow normalizes saving login state after authentication and reloading it in later sessions without discussing security boundaries. That makes risky persistence feel routine and may lead users or agents to store reusable authenticated sessions in plain files, which can be stolen or misapplied to impersonate the user.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

In this markdown file, the phrase "You need help using the CLI with this skill wrapper" is broad enough to overlap with common support requests and does not clearly define when a repository issue should be opened versus when other support channels should be used. The surrounding section gives examples, but it does not provide explicit exclusions or tighter trigger boundaries for this case.

Content

No source excerpt is available for this finding.