ClawHub
Back to skill

Security audit

Agent Browser Temp

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent browser automation wrapper, but it needs Review because it documents reusable authenticated browser sessions and mutable third-party installation without adequate safety boundaries.

Install only if you trust the agent-browser package source and are comfortable with an agent controlling browser sessions. Prefer pinned versions or reviewed commits, avoid production accounts when possible, treat saved state files like passwords, and delete screenshots, traces, videos, PDFs, cookies, and auth.json files when no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Unpinned Third-Party Dependencies Permit Unreviewed Code Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16-32; CONTRIBUTING.md:19-22
Vulnerability Type: Unpinned executable third-party dependencies and unsafe supply-chain installation
Risk Level: Medium

Vulnerable Code

SKILL.md:16-32:

bash
### npm recommended

```bash
npm install -g agent-browser
agent-browser install
agent-browser install --with-deps

From Source

bash
git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
pnpm install
pnpm build
agent-browser install
text

`CONTRIBUTING.md:19-22`:

```bash
1. Install the latest version
   ```bash
   npm install -g agent-browser@latest
   ```

Technical Analysis

The documented installation procedures retrieve and execute third-party software without pinning an exact npm package version, source commit, dependency lock state, or artifact integrity hash. In particular:

  • npm install -g agent-browser resolves whatever release is current under the package's default distribution tag.
  • npm install -g agent-browser@latest explicitly requests a mutable distribution tag.
  • Global npm installation may execute package lifecycle scripts with the installing user's privileges and places executable files in a shared global location.
  • git clone checks out the repository's mutable default branch rather than a reviewed commit or signed release tag.
  • pnpm install resolves third-party transitive dependencies from external registries. The documented workflow does not require a reviewed lockfile or frozen dependency resolution.
  • agent-browser install --with-deps can perform additional installation activity whose contents and effects depend on the retrieved version.

No evidence establishes that the currently referenced upstream project is malicious. The vulnerability is that the reviewed Skill does not constrain the executable content users will receive in the future. A compromised m ...[truncated 2139 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the npm package to a reviewed, exact version rather than using an implicit or explicit mutable tag:

    bash
    npm install --global --ignore-scripts agent-browser@<reviewed-exact-version>

    Enable lifecycle scripts only if they are required and have been reviewed.

  2. Pin source installations to a verified commit:

    bash
    git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
git checkout --detach <reviewed-commit-sha>

  3. Verify signed release tags, package provenance attestations, and published artifact checksums before installation.

  4. Require a committed lockfile and use frozen dependency resolution for source builds:

    bash
    pnpm install --frozen-lockfile

  5. Document the expected package integrity hash and introduce automated verification so installation fails when the downloaded artifact differs from the reviewed artifact.

  6. Prefer a project-local or isolated installation over a global installation. Run installation and browser automation under a dedicated, unprivileged account or container with restricted filesystem and network access.

  7. Review all package lifecycle scripts, build scripts, and the behavior of agent-browser install and agent-browser install --with-deps before approving a version upgrade.

  8. Replace the @latest recommendation in CONTRIBUTING.md with the same reviewed version used by the Skill, and establish an explicit dependency-update process involving source review, integrity verification, and security testing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents saving screenshots, PDFs, videos, traces, and session state to disk without warning that these artifacts can capture sensitive page contents, authentication state, personal data, or internal URLs. In browser automation for AI agents, such files are easy to retain, upload, or expose unintentionally, creating a realistic data leakage path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly documents commands for setting HTTP basic auth credentials and reading or modifying cookies/localStorage, but it provides no warning that these values are sensitive secrets or session tokens. In an agent context, this can normalize unsafe handling, logging, or reuse of credentials and authenticated state, increasing the chance of accidental credential exposure or session hijacking.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The skill supports saving and reloading browser session state, which commonly includes authentication cookies and other persistent identifiers, but it does not warn that these files are effectively bearer credentials. If an agent stores or reuses such state insecurely, an attacker or another workflow could impersonate the user or access protected resources without re-authentication.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

The authentication example encourages saving login state to a file and later reloading it for direct access to the dashboard, demonstrating a reusable authenticated session artifact without any security caveats. In context, this makes the persistence risk more operationally dangerous because it models exactly how to create and replay portable session credentials.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Static analysis

No suspicious patterns detected.