webtest

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:51 AM UTC
• Version: 1.0.1

Overview

This browser-testing skill has a legitimate purpose, but its instructions can drive live login, checkout, and admin workflows and include unsafe setup guidance that users should review carefully.

Install only if you are comfortable using browser automation on sites you control. Prefer staging or sandbox accounts, avoid real checkout or admin mutations unless explicitly intended, redact screenshots and reports, pin and verify agent-browser before installing it, and do not run the documented --no-sandbox command on sensitive or untrusted sites.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/run-guide.md:32

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Locations:

• references/run-guide.md:32
• references/windows-edge-fallback.md:10

Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Vulnerable Code:

bash

npm install -g agent-browser

Technical Analysis

The documentation directs users to install the latest available version of the third-party agent-browser npm package globally. The dependency is not pinned to a reviewed version, and the instructions do not require a lockfile, integrity hash, package provenance check, or verification against an official source.

Because npm packages can execute lifecycle scripts during installation, a compromised, malicious, or unexpectedly modified package release could execute code with the permissions of the user running npm. The global installation scope also increases the impact by placing package files and command shims in the user's global Node.js environment.

This is a supply-chain weakness rather than evidence that the current agent-browser package is malicious. The risk arises because the effective code installed in the future can change after this Skill has been reviewed.

Attack Path

1. An attacker compromises the package publisher account, the npm package, or its transitive dependency chain.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the documented npm install -g agent-browser instruction.
4. npm resolves the mutable latest release rather than a previously reviewed version.
5. Malicious package code or an installation lifecycle script executes under the user's account.
6. The installed global executable may subsequently run whenever the user invokes agent-browser.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running npm. Depending on that user's permissions and environment, an att ...[truncated 481 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin agent-browser to an exact version that has been reviewed, rather than installing the mutable latest release.
2. Document the expected official npm registry entry and upstream source repository so users can verify package identity.
3. Use a project-local dependency with a committed lockfile instead of a global installation.
4. Verify the resolved package integrity and provenance before installation.
5. Disable npm lifecycle scripts during installation where compatible, or inspect all required lifecycle scripts before allowing them to run.
6. Run the dependency in a disposable, least-privileged environment without access to unrelated credentials or sensitive files.
7. Establish a controlled update process in which new versions and transitive dependency changes are reviewed before the documented version is changed.

A hardened installation example should use a reviewed exact version:

bash

npm install --save-exact agent-browser@<reviewed-version>

The corresponding lockfile should be retained and verified in controlled deployments.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/run-guide.md:36

Finding

Browser Security Sandbox Disabled for User-Supplied Websites

Content

View full analysis

Vulnerability Details

File Locations:

• references/run-guide.md:36
• references/windows-edge-fallback.md:48
• references/windows-edge-fallback.md:77

Vulnerability Type: Unsafe browser execution configuration
Risk Level: Medium

Vulnerable Code:

From references/run-guide.md:

bash

MSYS_NO_PATHCONV=1 agent-browser --executable-path "$AGENT_BROWSER_EXECUTABLE_PATH" --args "--no-sandbox" open "https://你的网站"

From references/windows-edge-fallback.md:

bash

agent-browser --executable-path "$AGENT_BROWSER_EXECUTABLE_PATH" --args "--no-sandbox" open "https://目标网址"

bash

MSYS_NO_PATHCONV=1 agent-browser --executable-path "$AGENT_BROWSER_EXECUTABLE_PATH" --args "--no-sandbox" open "https://目标网址"

Technical Analysis

The documented browser commands pass --no-sandbox to Microsoft Edge. This disables an important Chromium security boundary that normally isolates renderer processes and untrusted web content from the host operating system.

The Skill is designed to open user-provided URLs and interact with their content. Consequently, the browser may process JavaScript, media, fonts, documents, and other attacker-controlled resources. If such content exploits a browser or renderer vulnerability, disabling the sandbox can materially reduce the additional work required to access the host under the browser user's permissions.

The documentation does not establish that disabling the sandbox is technically required for the Windows Edge fallback, nor does it restrict this configuration to a disposable virtual machine or similarly isolated environment.

Attack Path

1. A user requests testing of a malicious or compromised website, or an authorized test site loads an attacker-controlled third-party resource.
2. The user or Agent launches Edge using the documented --no-sandbox argument.
3. The browser renders attacker-controlled content without the normal Chromium sandbox b ...[truncated 1130 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --no-sandbox from all documented browser launch commands and retain the default Edge sandbox.
2. Confirm whether the Edge fallback operates correctly without this flag and make the sandboxed command the only standard workflow.
3. If a narrowly defined environment genuinely cannot use the browser sandbox, require execution inside a disposable, hardened virtual machine or equivalent isolation boundary.
4. Do not use unsandboxed mode with untrusted sites, sensitive browser profiles, privileged user accounts, or hosts containing production credentials.
5. Use a dedicated low-privilege operating-system account and a fresh browser profile for automated tests.
6. Restrict network access to only the target and required dependencies where practical.
7. Keep Edge and its browser engine fully patched before processing untrusted web content.
8. Add an explicit warning documenting the lost isolation boundary and the residual browser-exploitation risk.

The preferred command should omit the unsafe browser argument:

bash

MSYS_NO_PATHCONV=1 agent-browser --executable-path "$AGENT_BROWSER_EXECUTABLE_PATH" open "https://target.example"

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad, common phrases such as “网页测试” and especially “测一下这个网站,” which can match ordinary conversational requests and cause the skill to activate when the user did not explicitly intend to invoke browser-driven testing. In this skill’s context, unintended invocation is more concerning because the skill may drive a browser against user-supplied URLs and perform automated actions, increasing the chance of accidental navigation or testing on unintended sites.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly automates browser interactions for login, checkout, form submission, and admin-console flows, which can cause real state changes on live sites. Although the skill says to test only authorized sites, it does not prominently warn users before execution that actions may submit data, place orders, modify records, or trigger workflows, creating a meaningful risk of unintended production impact.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all operational guidance exclusively in Chinese, which can amount to a language policy violation when no user opt-in, alternative language option, or documented regional justification is provided. The policy for this audit specifically flags skills that force a specific language or locale without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example embeds realistic-looking credentials and demonstrates a full order-submission workflow without any warning that only non-production test accounts and non-destructive environments should be used. In a browser automation skill, users may copy the example verbatim or adapt it to real systems, which can lead to unauthorized account use, accidental purchases, state-changing actions, and leakage of secrets through logs, screenshots, or reports.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This is a markdown file, so SQP-2 applies to user-facing descriptions of behaviors affecting privacy or data. Line L056 tells users to save a screenshot as evidence, but the document does not warn that screenshots may contain personal, confidential, or production data from the target page.

Content

No source excerpt is available for this finding.