ClawHub
Back to skill

Security audit

My Agent Browser

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent browser-automation skill, but users should handle saved sessions and page captures as sensitive data.

Install only from a trusted npm package version, preferably pinned to an exact reviewed release. Avoid saving browser state for sensitive accounts unless necessary, keep state files private, delete them after use, and do not share screenshots, PDFs, videos, traces, or saved state files without reviewing them for secrets.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Third-Party Package Installation

Content
View full analysis
Remediation
View remediation
``` 2. Prefer a project-local dependency managed through a committed lockfile instead of a global installation: ```bash npm install --save-exact agent-browser@ ``` 3. Commit and enforce a lockfile with npm integrity metadata, and use deterministic installation commands such as `npm ci`. 4. Document the expected package publisher, registry, release provenance, and integrity information. Where practical, verify package signatures, attestations, or published checksums before execution. 5. Remove the recommendation to install `@latest`. Upgrade only after reviewing and testing the new exact version. 6. Separate browser installation from operating-system dependency installation. Clearly identify operations that may require elevated privileges and require explicit user review before running `--with-deps`. 7. Execute installation in a least-privileged environment, such as an isolated container or dedicated user account, particularly when evaluating a new upstream release. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation promotes screenshots, PDFs, and video recording without warning that these artifacts can capture credentials, personal data, session identifiers, and confidential page contents. For agent-operated browsers, automatic artifact generation can silently exfiltrate or persist sensitive data beyond the live session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly demonstrates saving and reusing authenticated browser state but provides no warning that the saved state file may contain cookies, tokens, or other session material that can impersonate a user. In an agent context, this increases the risk of credential/session leakage, reuse across tasks, or accidental persistence of privileged access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The state save/load commands enable persistence of browser authentication material across runs, which can preserve active sessions and bypass reauthentication. If the state file is exposed or reused improperly, an attacker or unintended workflow could inherit authenticated access.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

The authentication example normalizes loading previously saved authenticated state without discussing the security consequences of carrying over cookies and tokens into future sessions. In a multi-task or multi-user agent environment, this can cause privilege confusion, unauthorized reuse, or leakage of authenticated access.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text