Agent Browser Zc

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:29 AM UTC
• Version: 0.2.4

Overview

This browser automation skill is coherent, but it needs review because it installs a mutable global CLI and documents persistent login state without enough credential-safety guidance.

Install only if you are comfortable with an agent controlling browser sessions and handling authenticated pages. Prefer a pinned reviewed agent-browser version, avoid installing as root, use low-privilege or test accounts, keep saved auth state files out of repositories and shared workspaces, restrict file permissions, and delete or rotate saved sessions after use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20
• Finding: Unpinned Third-Party Browser Automation Dependency## Vulnerability Details **File Location**: `SKILL.md:20-30`; `CONTRIBUTING.md:25` **Vulnerability Type**: Unpinned and mutable executable dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:20-22`: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` `SKILL.md:28-30`: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install ``` `CONTRIBUTING.md:25`: ```bash npm install -g agent-browser@latest ``` ### Technical Analysis The installation instructions retrieve executable third-party content without pinning an audited npm package version, Git commit, or integrity hash. In particular, `@latest` explicitly selects a mutable release, while cloning the repository without a commit or tag executes the contents of its mutable default branch. Running `pnpm install` may also execute package lifecycle scripts from the project and its dependency graph. The global npm installation expands the potential impact because the package is installed into the user's global environment and exposes commands through the user's executable search path. The subsequent browser installation commands retrieve additional executable browser components or system dependencies. This is a supply-chain weakness rather than evidence that the current upstream package is malicious. Exploitation depends on compromise of the npm package, upstream repository, maintainer account, release process, or transitive dependency. ### Attack Path 1. An attacker compromises the `agent-browser` npm package, an upstream maintainer account, the repository's default branch, or a transitive dependency. 2. The attacker publishes or commits a malicious version containing installation lifecycle code, build logic, or a modified CLI executable. 3. A user or agent follows the documented `npm install -g agent-browser`, `npm install -g agent-browser@latest`, or unpinned ...[truncated 1465 chars]
• Remediation: ## Remediation Suggestions 1. Pin the npm package to a specific reviewed version, for example: ```bash npm install --global agent-browser@<reviewed-version> ``` Do not use `@latest` in installation or troubleshooting instructions. 2. Pin source installations to an immutable reviewed commit: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout --detach <reviewed-commit-sha> ``` 3. Publish expected package integrity hashes or signed release information and instruct users to verify them before installation. 4. Use and retain a lockfile for source builds. Install with frozen-lockfile behavior so dependency resolution cannot silently change: ```bash pnpm install --frozen-lockfile ``` 5. Prefer project-local or isolated installation over global installation. Run the tool in a container, sandbox, or dedicated low-privilege account when it will handle sensitive browser sessions. 6. Review package lifecycle scripts and the transitive dependency graph before approving a release. Where compatible with the installation process, disable lifecycle scripts during dependency retrieval and execute only explicitly reviewed build steps. 7. Document the exact relationship between the Skill version, approved CLI version, source commit, and browser component versions so installations are reproducible. 8. Warn users not to run installation as root or with `sudo`, and protect saved authentication-state files with restrictive permissions and exclusion from version control.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs users to save and later reload authentication state without warning that the resulting file may contain cookies, tokens, and other session artifacts. In an agent context, this can lead to persistent credential reuse, accidental disclosure through logs or workspace sharing, and unauthorized access if the file is copied or exfiltrated.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The command `set credentials user pass` places secrets directly on the command line, which may expose them through shell history, process listings, logs, or agent transcripts. In multi-user or monitored environments, this can leak authentication material and enable account compromise.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 90% confidence
• Finding: Saving and loading browser session state introduces durable session persistence, which can retain cookies, local storage, and authentication state beyond the original task. In an agent-operated environment, that increases the blast radius of compromise and may enable later unauthorized actions under a reused identity.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 92% confidence
• Finding: The example normalizes reusing a saved authenticated state for later sessions without discussing risks such as token theft, stale privileged sessions, or cross-task identity confusion. Because this skill is specifically for automated browsing by agents, persisted login state is more dangerous than in a manual one-off workflow.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The documented screenshot and PDF commands write files to local paths but do not warn that existing files may be created or overwritten. In an automated agent workflow, this can cause unintended modification of the local filesystem or leakage of sensitive page content into persistent artifacts.

Static analysis

No suspicious patterns detected.