Security audit

Agent Browser Temp

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a legitimate browser automation helper, but it gives an agent broad control over logged-in web sessions and sensitive browser data without clear safety boundaries.

Install only if you are comfortable trusting the external agent-browser npm CLI. Use a separate browser profile or disposable session where possible, avoid sensitive logged-in accounts unless necessary, keep saved state files such as auth.json private, and require explicit user confirmation before purchases, account changes, public posts, file uploads, credential use, or exposing cookies/localStorage.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill description materially understates the capability surface. While presented as simple browser navigation and form automation, the body documents much more powerful features including arbitrary JavaScript execution, network interception/mocking, credential/header injection, cookie and storage manipulation, and persistent session state, which can mislead downstream agents or reviewers about the real risk profile.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: `agent-browser eval` enables arbitrary JavaScript execution in the context of whatever page is open. In an agent setting, this can be used to read page data, manipulate application state, trigger privileged actions, or bypass the intended structured-command safety model, making the capability significantly more dangerous than ordinary click/type automation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises commands that can submit forms, upload files, change UI state, and alter browser/session data, but does not warn that these operations can modify remote systems or persist local and server-side changes. In agent workflows, absent warnings increase the chance of unintended destructive or privacy-impacting actions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documented credential and session-state features handle authentication material but provide no warning about secret exposure, reuse, or insecure storage. Saved auth state, headers, cookies, and credentials can grant account access if leaked or reused across sessions, making this especially sensitive in autonomous agent environments.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Screenshots, PDFs, video recordings, traces, console logs, and network inspection can capture sensitive page contents, tokens, personal data, and proprietary information. Without a privacy warning, users or agents may collect and store sensitive artifacts unintentionally, increasing data leakage risk.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.