ClawHub
Back to skill

Security audit

Agent Browser Local

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is coherent and not malicious, but it should be reviewed because it installs a mutable third-party CLI and documents persistent authenticated browser state without adequate safety guidance.

Review the installer before use, prefer a pinned and trusted agent-browser version, avoid running installer commands with elevated privileges, and treat saved browser state, screenshots, traces, PDFs, and recordings as sensitive. Use separate per-task sessions and delete auth.json or other captured artifacts when no longer needed, especially for important accounts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Third-Party Package and Source Installation

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:17-26
  • CONTRIBUTING.md:23-26

Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:17-26

bash
npm install -g agent-browser
agent-browser install
agent-browser install --with-deps
bash
git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
pnpm install
pnpm build
agent-browser install

CONTRIBUTING.md:23-26

bash
1. Install the latest version
   ```bash
   npm install -g agent-browser@latest
   ```

Technical Analysis

The installation instructions retrieve and execute mutable third-party content without pinning an audited package version, source commit, or dependency integrity value.

npm install -g agent-browser resolves the package version according to the npm registry's current state, while agent-browser@latest explicitly follows a mutable distribution tag. Consequently, the installed artifact can change after this Skill has been reviewed. npm package installation may also execute lifecycle scripts with the privileges of the invoking user.

The source installation procedure clones the repository's default branch rather than a specific audited commit or signed release. It then runs pnpm install and pnpm build, allowing the current upstream source and its transitive dependency graph to execute build or lifecycle logic. No lockfile, frozen dependency resolution, checksum, signature, or provenance verification is required by the instructions.

The subsequent agent-browser install --with-deps command may install additional browser or system dependencies, increasing the amount of externally sourced code and potentially requiring elevated permissions depending on the host configuration.

Attack Path

  1. An attacker compromises the npm package, its mutable latest release, the upstream repository, a maintainer ac ...[truncated 1666 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin agent-browser to a specifically reviewed version rather than using an implicit version or @latest, for example:

    bash
    npm install --global agent-browser@<audited-version>

  2. Record and verify the expected npm package integrity digest and package provenance before installation. Document the trusted publisher and official package identity to reduce dependency-confusion and package-substitution risk.

  3. For source installation, check out a specific audited commit or signed release:

    bash
    git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
git checkout --detach <audited-commit-sha>

    Verify the commit or release signature where upstream signing is available.

  4. Require a committed lockfile and use frozen dependency resolution, such as:

    bash
    pnpm install --frozen-lockfile

    Review dependency changes before updating the pinned source revision or package version.

  5. Avoid global installation where possible. Prefer an isolated project environment, container, or restricted execution account with access only to the files and network destinations required for browser automation.

  6. Do not run npm, pnpm, build scripts, or agent-browser install --with-deps with administrative privileges unless explicitly necessary. Separate operating-system dependency installation from package installation and review the exact system changes first.

  7. Document expected lifecycle and installer behavior. Where practical, initially inspect packages with lifecycle scripts disabled, review the scripts, and only then permit required installation actions.

  8. Replace the recommendation in CONTRIBUTING.md to install @latest with the same audited version used by the Skill, and update that version only after a new security review.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly demonstrates saving and reloading authenticated browser state (auth.json) but provides no warning that this file may contain reusable session cookies, tokens, or other authentication material. In an agent context, this can lead to accidental credential persistence, reuse across tasks, or leakage if the file is stored insecurely, shared, or committed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

state save and state load enable persistence of browser session data across runs, which can include authenticated cookies and storage. In an agent-operated environment, persisted session artifacts can be reused by unintended tasks or users if not protected, effectively turning a convenience feature into credential/session replay risk.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The example normalizes reusing previously saved authenticated state without discussing trust boundaries or expiry, which may encourage insecure long-lived session reuse. If such files are copied, exposed, or left on disk, an attacker or unrelated workflow could inherit authenticated access without needing credentials.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The documentation describes file-writing operations such as screenshots, PDFs, recordings, traces, state files, and uploads without warning that these actions create or consume local files that may contain sensitive page content or overwrite existing data. In an automation skill, agents may perform these actions non-interactively, increasing the risk of unintended local data exposure or persistence.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.