ClawHub
Back to skill

Security audit

Agent Browser 0

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent browser-automation skill, but users should handle saved sessions, uploads, screenshots, and the external CLI install with care.

Install only if you trust the upstream agent-browser npm package and its installer. Prefer a pinned version, avoid running installers with elevated privileges, use isolated browser sessions for untrusted sites, confirm file uploads explicitly, and treat auth.json, cookies, traces, screenshots, PDFs, and recordings like secrets.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Unpinned Global npm Installation Exposes Users to Supply-Chain Risk

Content
View full analysis
Remediation
View remediation
``` 2. Publish and verify the expected npm integrity hash and package provenance or signature where supported. 3. Prefer a project-local installation over a global installation to reduce the scope of package modification: ```bash npm install --save-exact agent-browser@ ``` 4. Commit and enforce a lockfile for source-based installation, and use a frozen or clean installation mode such as `npm ci` or the corresponding pnpm option. 5. Review package lifecycle scripts and transitive dependencies before approving a release. Consider disabling lifecycle scripts during initial retrieval when operationally possible. 6. Pin source installation instructions to an audited commit or release tag instead of the repository's mutable default branch. 7. Document every artifact downloaded by `agent-browser install`, including its source, version, checksum, signature, destination, and required privileges. 8. Avoid running npm or the installer as root or through `sudo`. If operating-system dependencies require elevation, isolate those steps and use an explicit, reviewed package list. 9. Establish an update process that reviews and tests new versions before changing the documented pinned version. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill describes file upload and state-preserving browser operations without warning that local files, cookies, and storage may be transmitted to remote sites. In an agent setting, this can cause unintended exfiltration of local data or authenticated session context to attacker-controlled pages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly documents saving and reusing authenticated browser state without warning that session files can contain cookies and other authentication artifacts. If users store or share these files insecurely, they may enable account takeover or unauthorized reuse of authenticated sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

Saving and loading browser session state creates reusable authentication artifacts that may persist beyond the intended task. If the saved file is exposed, copied, or reused in another context, an attacker may inherit authenticated access without needing credentials.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The authentication example normalizes persisting login state across sessions without discussing the security consequences of storing reusable authenticated context. In a multi-agent or shared workspace environment, this increases the likelihood of silent credential/session reuse and unauthorized access.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The documentation encourages writing screenshots and PDFs to local files but does not warn that these artifacts may capture sensitive page contents such as personal data, tokens, or internal application state. It also omits overwrite and file-permission considerations, increasing the chance of accidental local disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.