ClawHub
Back to skill

Security audit

Agent Browser

Security checks for vulnerabilities and agentic risk

Overview

This browser-automation skill is coherent, but it needs Review because it encourages a mutable global CLI install and documents reusable login/session data persistence without clear safety guidance.

Install only if you are comfortable trusting the external agent-browser npm package and giving it browser-automation authority. Prefer a pinned, reviewed version in a sandbox or container, avoid privileged installs, do not pass real passwords on the command line, and treat auth.json, screenshots, PDFs, videos, and traces as sensitive files that should be protected and deleted when no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Global Installation and Execution of an External npm Package

Content
View full analysis
Remediation
View remediation
``` 2. Publish and verify the expected npm integrity digest and package provenance before installation. 3. Prefer a project-local dependency governed by a committed lockfile instead of a global installation. 4. Audit the pinned package, transitive dependencies, lifecycle scripts, and any URLs used to download browser binaries or other components. 5. Avoid invoking `--with-deps` automatically. Clearly identify the operating-system changes it can make and require explicit user approval before privileged installation. 6. Run installation and browser automation in a sandbox or container with minimal filesystem, credential, and network access. 7. Document a verified upgrade procedure so version changes trigger a new security review rather than silently changing the executable payload. ]]>

T08 · Insecure Dependencies

Warning
Location
CONTRIBUTING.md:20
Finding

Explicit Installation of the Mutable Latest npm Release

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation promotes screenshots, PDFs, videos, and other saved artifacts without warning that they may capture secrets, personal data, or authenticated content and write it to disk. In agent workflows, automatic file creation can silently persist sensitive information where other tools, users, or later runs can access it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly documents cookie, localStorage, credential, and session-state operations without warning that these artifacts can contain authentication tokens, passwords, or reusable session material. In an agent setting, this increases the chance that sensitive data is exposed in command history, logs, stdout, or persisted files and then reused outside the intended session.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

Session persistence is explicitly supported through saving and loading browser state, which commonly includes cookies and tokens that can authenticate future sessions. Without warnings or constraints, agents may persist reusable auth material to disk and reload it across tasks, increasing the risk of account takeover if the file is exposed.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The example workflow normalizes saving authenticated state to 'auth.json' and reusing it later, effectively teaching credential/session token persistence. In the context of an agent skill, this is more dangerous because agents may automate the pattern broadly and leave behind portable authentication artifacts that can be copied or misused.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text