Agent Browser 0

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:10 PM UTC
• Version: 1.0.0

Overview

This is a coherent browser-automation skill, but users should handle saved sessions, uploads, screenshots, and the external CLI install with care.

Install only if you trust the upstream agent-browser npm package and its installer. Prefer a pinned version, avoid running installers with elevated privileges, use isolated browser sessions for untrusted sites, confirm file uploads explicitly, and treat auth.json, cookies, traces, screenshots, PDFs, and recordings like secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18
• Finding: Unpinned Global npm Installation Exposes Users to Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:18-21`; `CONTRIBUTING.md:23-26` **Vulnerability Type**: Unpinned and mutable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:18-21`: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` `CONTRIBUTING.md:23-26`: ```bash npm install -g agent-browser@latest ``` ### Technical Analysis The documented installation process globally installs `agent-browser` without pinning an audited version. The contributing instructions explicitly select the mutable `latest` release. Consequently, the package and its transitive dependencies resolved when a user runs these commands may differ from those reviewed when this skill was published. npm installations can execute package lifecycle scripts with the permissions of the invoking user. After installation, the documented `agent-browser install` and `agent-browser install --with-deps` commands can also retrieve browser binaries or system components. Their implementations and downloaded artifacts are not included in this documentation-only project and therefore could not be verified during this audit. This does not prove that the current upstream package is malicious. The risk arises if the package publisher, registry account, upstream release process, transitive dependency, or installer download channel is compromised. ### Attack Path 1. An attacker compromises the upstream npm package, a transitive dependency, publisher credentials, or an artifact downloaded by the installer. 2. The attacker publishes a malicious release that becomes the unversioned default or the `latest` release. 3. A user or agent follows the documented command and globally installs the mutable package. 4. Malicious npm lifecycle code executes during installation, or malicious code executes when `agent-browser install` is subsequently invoked. 5. The payload performs actions available to the invoking acc ...[truncated 1101 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `agent-browser` to a specific, audited version rather than using an unversioned package or `@latest`, for example: ```bash npm install -g agent-browser@<audited-version> ``` 2. Publish and verify the expected npm integrity hash and package provenance or signature where supported. 3. Prefer a project-local installation over a global installation to reduce the scope of package modification: ```bash npm install --save-exact agent-browser@<audited-version> ``` 4. Commit and enforce a lockfile for source-based installation, and use a frozen or clean installation mode such as `npm ci` or the corresponding pnpm option. 5. Review package lifecycle scripts and transitive dependencies before approving a release. Consider disabling lifecycle scripts during initial retrieval when operationally possible. 6. Pin source installation instructions to an audited commit or release tag instead of the repository's mutable default branch. 7. Document every artifact downloaded by `agent-browser install`, including its source, version, checksum, signature, destination, and required privileges. 8. Avoid running npm or the installer as root or through `sudo`. If operating-system dependencies require elevation, isolate those steps and use an explicit, reviewed package list. 9. Establish an update process that reviews and tests new versions before changing the documented pinned version. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill describes file upload and state-preserving browser operations without warning that local files, cookies, and storage may be transmitted to remote sites. In an agent setting, this can cause unintended exfiltration of local data or authenticated session context to attacker-controlled pages.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly documents saving and reusing authenticated browser state without warning that session files can contain cookies and other authentication artifacts. If users store or share these files insecurely, they may enable account takeover or unauthorized reuse of authenticated sessions.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 94% confidence
• Finding: Saving and loading browser session state creates reusable authentication artifacts that may persist beyond the intended task. If the saved file is exposed, copied, or reused in another context, an attacker may inherit authenticated access without needing credentials.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 95% confidence
• Finding: The authentication example normalizes persisting login state across sessions without discussing the security consequences of storing reusable authenticated context. In a multi-agent or shared workspace environment, this increases the likelihood of silent credential/session reuse and unauthorized access.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The documentation encourages writing screenshots and PDFs to local files but does not warn that these artifacts may capture sensitive page contents such as personal data, tokens, or internal application state. It also omits overwrite and file-permission considerations, increasing the chance of accidental local disclosure.

Static analysis

No suspicious patterns detected.