My Agent Browser

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:01 AM UTC
• Version: 1.0.0

Overview

This is a coherent browser-automation skill, but users should handle saved sessions and page captures as sensitive data.

Install only from a trusted npm package version, preferably pinned to an exact reviewed release. Avoid saving browser state for sensitive accounts unless necessary, keep state files private, delete them after use, and do not share screenshots, PDFs, videos, traces, or saved state files without reviewing them for secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned Third-Party Package Installation<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:17-19` - `CONTRIBUTING.md:15-17` **Vulnerability Type**: Mutable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:17-19`: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` `CONTRIBUTING.md:15-17`: ```bash npm install -g agent-browser@latest ``` ### Technical Analysis The installation instructions retrieve and execute an unpinned npm package. Both the versionless package reference and the explicit `@latest` tag resolve to a release that can change after this Skill has been reviewed. The project does not include a lockfile, integrity hash, provenance requirement, or vendored implementation that constrains which package contents are installed. The package is installed globally and its installer is subsequently executed. The `agent-browser install --with-deps` command may also install or modify browser and operating-system dependencies. Consequently, the effective code executed by users is controlled by the package version available from the external registry at installation time rather than by the audited project contents. This is a supply-chain weakness. The reviewed files do not establish that the current upstream package is malicious; the risk arises because a compromised maintainer account, registry release, mutable distribution tag, or unexpectedly changed upstream version could cause unaudited code to execute. ### Attack Path 1. An attacker compromises the upstream npm package, its publisher account, or the release process. 2. The attacker publishes a malicious package version and assigns it to the version selected by the unversioned or `@latest` installation command. 3. A user follows the documented installation procedure. 4. npm downloads and installs the attacker-controlled release globally. 5. Package lifecycle scripts or the subsequent `agent-browser install` command execute the compromised co ...[truncated 1011 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `agent-browser` to an exact, reviewed version rather than using an unversioned package or `@latest`, for example: ```bash npm install -g agent-browser@<reviewed-exact-version> ``` 2. Prefer a project-local dependency managed through a committed lockfile instead of a global installation: ```bash npm install --save-exact agent-browser@<reviewed-exact-version> ``` 3. Commit and enforce a lockfile with npm integrity metadata, and use deterministic installation commands such as `npm ci`. 4. Document the expected package publisher, registry, release provenance, and integrity information. Where practical, verify package signatures, attestations, or published checksums before execution. 5. Remove the recommendation to install `@latest`. Upgrade only after reviewing and testing the new exact version. 6. Separate browser installation from operating-system dependency installation. Clearly identify operations that may require elevated privileges and require explicit user review before running `--with-deps`. 7. Execute installation in a least-privileged environment, such as an isolated container or dedicated user account, particularly when evaluating a new upstream release. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation promotes screenshots, PDFs, and video recording without warning that these artifacts can capture credentials, personal data, session identifiers, and confidential page contents. For agent-operated browsers, automatic artifact generation can silently exfiltrate or persist sensitive data beyond the live session.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly demonstrates saving and reusing authenticated browser state but provides no warning that the saved state file may contain cookies, tokens, or other session material that can impersonate a user. In an agent context, this increases the risk of credential/session leakage, reuse across tasks, or accidental persistence of privileged access.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 95% confidence
• Finding: The state save/load commands enable persistence of browser authentication material across runs, which can preserve active sessions and bypass reauthentication. If the state file is exposed or reused improperly, an attacker or unintended workflow could inherit authenticated access.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 96% confidence
• Finding: The authentication example normalizes loading previously saved authenticated state without discussing the security consequences of carrying over cookies and tokens into future sessions. In a multi-task or multi-user agent environment, this can cause privilege confusion, unauthorized reuse, or leakage of authenticated access.

Static analysis

No suspicious patterns detected.