Agent Browser Core 1.0.1

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:39 PM UTC
• Version: 1.0.0

Overview

This skill is a documentation-only browser automation playbook with disclosed safety limits and no embedded executable code, though users should pin and isolate any external installs.

Install only a reviewed, pinned agent-browser version in an isolated, unprivileged environment. Treat browser state, cookies, credentials, and saved sessions as secrets, and require explicit approval before enabling eval, file access, proxies, custom browser arguments, or traffic interception.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/agent-browser-overview.md:8

Finding

Unverified Third-Party Package and Runtime Installation

Content

View full analysis

Vulnerability Details

File Location: references/agent-browser-overview.md, lines 8-14
Additional Location: references/agent-browser-troubleshooting.md, lines 4-5
Vulnerability Type: Supply-chain risk from externally retrieved packages and executable components
Risk Level: Medium

Vulnerable Code Snippet

From references/agent-browser-overview.md, lines 8-14:

sh

# Pin the version you trust:
npm install -g agent-browser@<version>
# Prefer a dedicated environment or container for installs.
# Avoid running with elevated OS privileges.
# Install browser runtime:
agent-browser install
# Linux dependencies (if needed):
agent-browser install --with-deps

A related alternative appears in the same section:

sh

npx playwright install-deps chromium

From references/agent-browser-troubleshooting.md, lines 4-5:

sh

agent-browser install
agent-browser install --with-deps

Technical Analysis

The documentation instructs users to install and execute externally sourced npm, Playwright, browser-runtime, and operating-system dependency components. Although it recommends pinning a trusted version, the command contains the placeholder @<version> rather than a concrete, reviewed, immutable version. It also provides no package-integrity, signature, checksum, lockfile, or trusted-registry validation procedure.

npm install -g can execute package lifecycle scripts and modifies the global Node.js environment. An npx invocation may resolve and execute a package obtained from a configured external registry when the required package is not already installed locally. The runtime installation commands can also retrieve executable browser components. Consequently, the effective code executed during setup is not fully represented by the audited skill files and may change based on package resolution, registry state, selected version, or upstream compromise.

The p ...[truncated 1929 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @<version> with an exact, reviewed version and document the approved version explicitly. Do not use version ranges, latest, or floating tags.
2. Prefer a project-local, lockfile-backed installation using package-lock.json and npm ci rather than a global npm installation.
3. Use an explicitly configured trusted registry and verify package provenance, signatures, and published integrity metadata before installation.
4. Avoid implicit npx downloads. Use npx --no-install with a previously verified local dependency, or invoke the pinned local binary directly.
5. Pin the Playwright and browser-runtime versions and document the expected checksums or official signature-verification procedure.
6. Perform installation in a dedicated, unprivileged container or sandbox with restricted filesystem and network access.
7. Disable npm lifecycle scripts during acquisition where feasible, review required scripts separately, and enable them only after verification.
8. Preserve the existing warning against elevated privileges and make it an explicit requirement.
9. Add upgrade procedures requiring security review and integrity validation before changing any pinned version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The documentation recommends npx playwright install-deps chromium, which invokes an unpinned package resolution path. If a user runs this command later, they may fetch whatever Playwright version is current at execution time, creating supply-chain and reproducibility risk and potentially pulling in unexpected code or dependency behavior. In this skill’s context, that risk is more significant because the browser tooling is described as high privilege and intended for agent-driven automation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.