Agent Browser 0.2.0 (1)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:36 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is coherent, but it needs Review because it recommends mutable installs and normalizes saving reusable browser session state without clear safety warnings.

Install only if you trust the agent-browser upstream package and are comfortable with a skill that can automate authenticated browser sessions. Prefer a pinned package version or audited commit, avoid running it with admin privileges, use test or low-privilege accounts, and treat saved state files, recordings, cookies, and localStorage exports like credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:19
• Finding: Unpinned Mutable Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:19-32`; additional occurrence at `CONTRIBUTING.md:23-26` **Vulnerability Type**: Unpinned third-party package and source installation **Risk Level**: High **Vulnerable code in `SKILL.md:19-32`:** ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build agent-browser install ``` **Additional vulnerable code in `CONTRIBUTING.md:23-26`:** ```bash npm install -g agent-browser@latest ``` ### Technical Analysis The installation instructions retrieve and execute mutable third-party content without pinning an audited npm package version, Git commit, checksum, or cryptographic signature. The explicit use of `@latest` guarantees that the installed artifact can change independently of this Skill's reviewed contents. Cloning the repository's default branch creates the same issue because the referenced branch can be modified after the audit. Installing the npm package may execute package lifecycle scripts. The subsequent `agent-browser install`, `pnpm install`, and `pnpm build` commands also execute code obtained from external package registries or the mutable upstream repository. The global npm installation expands the potential effect to the user's global Node.js environment. This finding does not establish that the current upstream package is malicious. It establishes that the reviewed Skill does not provide a reproducible trust boundary and that future or compromised upstream content could execute without a corresponding change to this repository. ### Attack Path 1. An attacker compromises the upstream npm publisher account, package release process, dependency tree, or Git repository. 2. The attacker publishes a malicious `agent-browser` release, modifies the default Git branch, or compromises a transitive depend ...[truncated 1156 chars]
• Remediation: ## Remediation Suggestions 1. Pin `agent-browser` to an explicitly reviewed version, for example `agent-browser@X.Y.Z`, rather than using an implicit current version or `@latest`. 2. Pin source-based installation to a full audited Git commit hash instead of the repository's mutable default branch. 3. Publish and verify cryptographic checksums or signatures for downloaded artifacts before installation or execution. 4. Use a committed lockfile with integrity metadata for all Node.js and pnpm dependencies, and require immutable or frozen-lockfile installation. 5. Avoid global installation where possible. Install the dependency in an isolated project, container, sandbox, or dedicated low-privilege environment. 6. Disable npm lifecycle scripts during dependency retrieval when feasible, review required scripts separately, and execute them only after verification. 7. Document the exact trusted package version, repository commit, expected checksum, Node.js version, and installation procedure in `SKILL.md`. 8. Replace the recommendation to install `@latest` in `CONTRIBUTING.md` with a pinned, audited version and a controlled update process. 9. Run browser automation without administrative privileges and restrict access to unrelated credentials, authentication state, and sensitive local files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest description presents the skill as general browser automation but omits materially sensitive capabilities exposed in the documentation, including arbitrary JavaScript execution, request interception/mocking, cookie and localStorage manipulation, and session state export/import. This can cause downstream agents or users to grant or invoke the skill without understanding that it can execute active code in page context and access or persist authentication material.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The recording feature is documented as preserving cookies and storage from the current session, but there is no warning that captured video, preserved state, and subsequent artifacts may expose authenticated content, personal data, or secrets displayed in the browser. In an agent setting, this increases the chance of silent collection and retention of privacy-sensitive data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The state save/load workflow documents persistence of browser session state without warning that saved files may contain cookies, tokens, and other authentication artifacts. If those files are stored insecurely, shared, or reused across environments, an attacker could hijack authenticated sessions or extract sensitive data.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 94% confidence
• Finding: Documenting session persistence as a routine feature without safeguards encourages storage and reuse of browser authentication state. In the context of a browser automation skill, persisted session files can function as bearer credentials and enable account takeover or unauthorized data access if mishandled.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 95% confidence
• Finding: The authentication example normalizes saving and later reloading authenticated state, but does not warn that auth.json may contain reusable credentials or session cookies. Because this is an explicit login workflow, the skill context makes the risk more acute: users are likely to apply it to real accounts and environments.

Static analysis

No suspicious patterns detected.