T08 · Insecure Dependencies
Warning
- Location
SKILL.md:1- Finding
Unpinned npx Package Execution Creates a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Browser
Security checks for vulnerabilities and agentic risk
Overview
This browser automation skill is mostly purpose-aligned, but it needs review because it can run an unpinned npm package and encourages reusable authenticated browser state without strong handling controls.
Install only if you are comfortable with a powerful browser automation tool. Prefer a pinned, reviewed agent-browser version instead of unpinned npx; avoid real credentials in examples; store auth-state, screenshots, videos, profiles, and traces outside shared or version-controlled locations with restrictive permissions; clear sessions after use; and avoid using saved sessions on sensitive accounts unless explicitly needed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
templates/authenticated-session.sh:22- Finding
Authentication State Is Persisted Without Enforced Access Controls
- Content
View full analysis
[state-file]}" STATE_FILE="${2:-./auth-state.json}" ``` ```bash # # Save state for future runs # echo "Saving state to $STATE_FILE" # agent-browser state save "$STATE_FILE" ``` The same pattern is presented as active guidance in `references/session-management.md`: ```bash STATE_FILE="/tmp/auth-state.json" # Check if we have saved state if [[ -f "$STATE_FILE" ]]; then agent-browser state load "$STATE_FILE" agent-browser open https://app.example.com/dashboard else # Perform login agent-browser open https://app.example.com/login agent-browser snapshot -i agent-browser fill @e1 "$USERNAME" agent-browser fill @e2 "$PASSWORD" agent-browser click @e3 agent-browser wait --load networkidle # Save for future use agent-browser state save "$STATE_FILE" fi ``` ### Technical Analysis The documentation states that saved state contains cookies, local storage, session storage, origins, and authentication tokens. The provided workflows save this material to a relative project file or a predictable file under `/tmp`, but they do not enforce: - A restrictive process umask such as `077` - File mode `0600` - A private directory with mode `0700` - Ownership validation - Encryption at rest - Reliable cleanup through an exit trap Adding the files to `.gitignore` only prevents ordinary Git commits. It does not protect the files from other local users or processes while they exist. Actual exploitability depends on the permissions applied by `agent-browser`, the process umask, and directory access controls, none of which the Skill enforces. ### Att ...[truncated 1017 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
templates/form-automation.sh:54- Finding
Predictable Screenshot File in Shared Temporary Directory
- Content
View full analysis
- Remediation
View remediation
/dev/null || true' EXIT SCREENSHOT="$TEMP_DIR/form-result.png" agent-browser screenshot "$SCREENSHOT" ``` 2. Ensure the temporary directory has mode `0700` and generated files have mode `0600`. 3. Reject existing destinations and symbolic links before writing. 4. Use unique filenames for concurrent executions. 5. Remove the screenshot automatically unless the user explicitly requests retention. 6. If persistent evidence is required, move it to a user-selected protected directory and warn that it may contain sensitive page content. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (26)
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
Session recording can capture page contents, typed inputs, authentication flows, tokens visible in URLs, and other sensitive contextual data. In a browser automation skill that may be used for login and application testing, recording materially increases the risk of secret leakage through saved video artifacts.
- Content
bash agent-browser --headed open https://example.com agent-browser highlight @e1 # Highlight element agent-browser record start demo.webm # Record session agent-browser profiler start # Start Chrome DevTools profiling agent-browser profiler stop trace.json # Stop and save profile (path optional)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
-
Clean up after automation
bash agent-browser cookies clear rm -f ./auth-state.json -
Use short-lived sessions for CI/CD
-
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
echo "*.auth-state.json" >> .gitignore
Delete after use
rm /tmp/auth-state.json
text ### 4. Timeout Long Sessions
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Referencing
npx agent-browserin the manifest without an exact version permits fetching whatever version is current at execution time. In an agent skill, this creates a direct path for remote code execution through package substitution, malicious updates, or dependency compromise.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The invocation description is broad enough that the skill may activate for many generic browsing, login, scraping, or testing requests, causing the agent to use a powerful browser automation capability more often than necessary. In practice, overbroad triggering expands the attack surface and raises the chance of the agent being steered into handling credentials, session tokens, or untrusted web content without sufficient user confirmation.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The skill allows execution of
npx agent-browserwithout pinning an exact package version, which means the resolved code can change over time or be replaced by a compromised upstream release. Because this skill is explicitly designed for browser automation with access to websites, sessions, local state, and potentially credentials, an unpinned package materially increases supply-chain risk.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The authentication and state-persistence examples encourage saving and reusing browser state that may contain cookies, tokens, and other login artifacts, but they do not prominently warn that this data is sensitive and may grant account access. In an agent context, normalized reuse of saved auth state can lead to account takeover risk if the files are exposed, reused across tasks, or handled in shared environments.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 77% confidence
- Finding
The configuration example encourages persistent browser profiles in the project directory, which can retain cookies, local storage, cached tokens, and browsing history across runs. In multi-user workspaces, repositories, or shared agent environments, this persistence can leak session data or cause unintended reuse of privileged state.
- Content
Configuration File
Create
agent-browser.jsonin the project root for persistent settings:json {
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation includes hardcoded example credentials such as email addresses and plaintext passwords in authentication flows without placing an immediate warning near the examples. In a browser automation skill, users may copy these patterns directly into scripts or prompts, normalizing unsafe secret handling and increasing the chance that real credentials are exposed in shell history, logs, screenshots, or version control.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The state-saving section instructs users to persist authenticated browser state to a JSON file before any explicit warning that the file contains reusable session secrets. In this skill context, saved browser state can effectively function as a bearer token, so normalizing its storage without an upfront caution increases the risk of credential theft, accidental sharing, or repository leakage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Passing usernames and passwords directly on the command line can expose secrets through shell history, process listings, CI logs, and telemetry. Because this command reference presents the pattern without any warning or safer alternative, it promotes an unsafe secret-handling practice.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest describes navigation, form filling, clicking, screenshots, extraction, testing, login, and general browser interaction. While some scripting can support automation, documenting
evalwith base64 and stdin explicitly enables arbitrary code execution inside webpages, which is a broader capability than the core user-facing purpose described in the manifest.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The state save/load commands explicitly persist cookies, storage, and auth state, which can contain active session tokens and credentials. Documenting this without warning encourages unsafe handling of highly sensitive artifacts that could be copied, committed, or reused for account takeover.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 55% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash agent-browser state save auth.json # Save cookies, storage, auth state agent-browser state load auth.json # Restore saved stateGlobal Options
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest focuses on interacting with websites and automating browser tasks, but
--extension <path>adds the ability to run extra extension code with its own privileges and behaviors. That materially broadens the skill beyond straightforward browser automation and is not disclosed in the stated purpose.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The profiling documentation repeatedly instructs users to capture and save Chrome trace files but does not warn that these traces can contain sensitive data such as visited URLs, timing of authenticated actions, page structure details, and potentially application-specific markers or identifiers. In an agent-driven browser automation context, users may profile login flows, internal apps, or CI runs and then store or share the resulting JSON artifacts, increasing the chance of unintentional data exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation shows proxy credentials embedded directly in an environment-variable URL, but does not warn that secrets placed this way may be exposed through shell history, process listings, logs, CI output, or copied examples. In a browser automation skill, users are likely to paste these commands into real environments, increasing the chance of credential leakage to local observers or operational tooling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The SOCKS proxy example includes username and password in the proxy URL without any guidance on secret-handling risks. This can lead users to expose proxy credentials via shell history, scripts, logs, screenshots, or environment inspection, which is especially relevant for an automation tool that may run in shared developer machines or CI systems.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
The documentation explicitly shows loading a previously saved browser auth-state file, which can contain cookies and other authenticated session artifacts. In a browser automation skill, this is security-relevant because reuse of state files can enable credential/session hijacking if the file is stolen, shared across tasks, or loaded into the wrong context.
- Content
Load Session State
bash # Restore saved state agent-browser state load /path/to/auth-state.json # Continue with authenticated session
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation encourages recording browser sessions for debugging and verification but does not warn that videos can capture sensitive on-screen data such as credentials, session tokens, personal information, or internal application content. In the context of a browser automation skill that may be used for logins, form filling, and web app testing, this omission increases the risk of accidental collection and retention of sensitive data in artifacts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The template instructs users to place login credentials in environment variables but does not mention safe handling practices or the risk of exposing secrets through shell history, process inspection in some environments, CI logs, or inherited subprocess environments. While environment variables are common for automation, omitting any warning in a reusable auth template increases the chance that users will handle credentials insecurely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script saves authenticated browser session state to a JSON file and reuses it later, but provides no warning that this file may contain cookies, tokens, or other bearer credentials that can grant account access if copied. In a browser automation skill, this is particularly sensitive because the saved state is explicitly intended to bypass re-authentication, so accidental exposure of the file can directly enable session hijacking.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Cookie and localStorage inspection/manipulation commands can expose authentication tokens, personal data, and application secrets stored in the browser. In an agent-oriented browser skill, these commands are especially sensitive because they make it easy to extract or alter state without any privacy or handling guidance.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Viewing tracked network requests may reveal authorization headers, cookies, CSRF tokens, query secrets, and sensitive request/response bodies. The omission of a warning is risky because operators may capture or store this data inadvertently during routine automation tasks.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This markdown file demonstrates entering an email and password and submitting a login form, which affects user privacy and sensitive data handling. The surrounding documentation does not include any warning or disclosure about using real credentials, test accounts, or exercising caution with sensitive information.
- Content
Static analysis
No suspicious patterns detected.