Agent Browser

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

This browser-automation skill is coherent, but it needs Review because it encourages a mutable global CLI install and documents reusable login/session data persistence without clear safety guidance.

Install only if you are comfortable trusting the external agent-browser npm package and giving it browser-automation authority. Prefer a pinned, reviewed version in a sandbox or container, avoid privileged installs, do not pass real passwords on the command line, and treat auth.json, screenshots, PDFs, videos, and traces as sensitive files that should be protected and deleted when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned Global Installation and Execution of an External npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17-19 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` ### Technical Analysis The Skill instructs users or agents to install `agent-browser` globally without specifying an exact version or verifying an integrity hash. It then immediately executes the installed program to retrieve browser components and, through `--with-deps`, potentially install operating-system dependencies. Because the audited project contains only documentation and metadata, the npm package implementation and the additional components it downloads are outside the reviewed artifact. The effective executable content can therefore change after this Skill has been reviewed. Global npm installation may also execute package lifecycle scripts, including installation hooks, with the permissions of the invoking user. This creates a supply-chain trust boundary in which compromise of the npm package, its publisher account, its transitive dependencies, or its downstream download infrastructure could introduce arbitrary code. ### Attack Path 1. An attacker compromises the `agent-browser` npm package, its publishing account, a transitive dependency, or a download endpoint used by its installer. 2. The attacker publishes or serves a malicious package or component under the expected package name. 3. A user or agent follows the Skill instructions and runs `npm install -g agent-browser`. 4. npm retrieves the mutable package release and may execute its lifecycle scripts. 5. The user subsequently runs `agent-browser install` or `agent-browser install --with-deps`. 6. The malicious package or downloaded component executes with the invoking user's permissions. If the dependency installation is run through an elevated workflow, the resulting scope may extend to system-level modific ...[truncated 722 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the package to a reviewed, exact version rather than resolving the current registry release: ```bash npm install -g agent-browser@<audited-version> ``` 2. Publish and verify the expected npm integrity digest and package provenance before installation. 3. Prefer a project-local dependency governed by a committed lockfile instead of a global installation. 4. Audit the pinned package, transitive dependencies, lifecycle scripts, and any URLs used to download browser binaries or other components. 5. Avoid invoking `--with-deps` automatically. Clearly identify the operating-system changes it can make and require explicit user approval before privileged installation. 6. Run installation and browser automation in a sandbox or container with minimal filesystem, credential, and network access. 7. Document a verified upgrade procedure so version changes trigger a new security review rather than silently changing the executable payload. ]]>

T08 · Insecure Dependencies

Warning

• Location: CONTRIBUTING.md:20
• Finding: Explicit Installation of the Mutable Latest npm Release<![CDATA[ ## Vulnerability Details **File Location**: `CONTRIBUTING.md`, lines 20-23 **Vulnerability Type**: Mutable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash 1. Install the latest version ```bash npm install -g agent-browser@latest ``` ``` ### Technical Analysis The contribution instructions explicitly direct users to install the `latest` npm distribution tag globally. npm distribution tags are mutable pointers controlled by the package publisher and do not identify immutable, previously audited content. Consequently, two users following the same instructions at different times can receive different executable code. A global npm installation may run package lifecycle scripts and places the resulting executable in the user's global command path. The audited project does not provide a lockfile, integrity value, vendored source, or implementation that would allow the installed release to be validated against the reviewed artifact. ### Attack Path 1. An attacker obtains control of the npm publisher account, compromises the package release process, or introduces malicious code into a dependency. 2. The attacker publishes a malicious release and assigns the `latest` distribution tag to it. 3. A contributor follows the documented troubleshooting procedure and runs `npm install -g agent-browser@latest`. 4. npm downloads the attacker-controlled release and may execute malicious lifecycle hooks during installation. 5. The installed global executable can perform additional malicious actions when the contributor tests an `agent-browser` command. ### Impact Assessment Exploitation could result in arbitrary code execution under the contributor's account during installation or later command execution. The attacker could access files and secrets available to that user, modify user-owned development assets, tamper with globally installed tooling, or abuse authenticated browser sessions and development credentials pr ...[truncated 290 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, security-reviewed package version. 2. Verify package provenance and integrity before installation, and document the expected digest or other validation material. 3. Prefer a local, lockfile-controlled development dependency over a global installation. 4. Configure CI and contributor environments to ignore or restrict lifecycle scripts unless they are required and audited. 5. Test the dependency in an isolated container or sandbox without production credentials or access to sensitive host directories. 6. Require dependency-update review and automated supply-chain scanning before changing the pinned version. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation promotes screenshots, PDFs, videos, and other saved artifacts without warning that they may capture secrets, personal data, or authenticated content and write it to disk. In agent workflows, automatic file creation can silently persist sensitive information where other tools, users, or later runs can access it.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly documents cookie, localStorage, credential, and session-state operations without warning that these artifacts can contain authentication tokens, passwords, or reusable session material. In an agent setting, this increases the chance that sensitive data is exposed in command history, logs, stdout, or persisted files and then reused outside the intended session.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 88% confidence
• Finding: Session persistence is explicitly supported through saving and loading browser state, which commonly includes cookies and tokens that can authenticate future sessions. Without warnings or constraints, agents may persist reusable auth material to disk and reload it across tasks, increasing the risk of account takeover if the file is exposed.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 90% confidence
• Finding: The example workflow normalizes saving authenticated state to 'auth.json' and reusing it later, effectively teaching credential/session token persistence. In the context of an agent skill, this is more dangerous because agents may automate the pattern broadly and leave behind portable authentication artifacts that can be copied or misused.

Static analysis

No suspicious patterns detected.