Agent Browser Backup

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:13 AM UTC
• Version: 1.0.0

Overview

The skill is a straightforward browser-automation wrapper, but users should treat saved sessions, cookies, screenshots, recordings, and unpinned installs as sensitive.

Install only from a trusted reviewed version if possible. Do not save auth state, screenshots, PDFs, traces, or recordings from sensitive sites unless needed, and delete or protect those files afterward. Avoid putting real passwords or tokens directly in commands that may be logged.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16
• Finding: Mutable Third-Party Dependencies Are Installed and Executed Without Version or Commit Pinning## Vulnerability Details **File Location**: `SKILL.md:16-32`; `CONTRIBUTING.md:23-26` **Vulnerability Type**: Unpinned third-party package and source dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:16-32`: ```bash ### npm recommended ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` ### From Source ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build agent-browser install ``` ``` `CONTRIBUTING.md:23-26`: ```bash 1. Install the latest version ```bash npm install -g agent-browser@latest ``` ``` ### Technical Analysis The installation instructions retrieve and execute mutable third-party content. The npm commands install either the package's current default release or explicitly use the mutable `latest` distribution tag. The source installation procedure clones the repository's current default branch without checking out a reviewed commit or verifying a signed release. Package installation and source builds can execute npm/pnpm lifecycle and build scripts. Consequently, the code executed by these instructions may differ from the code that was available when this Skill was audited. A malicious or compromised future npm release, repository commit, maintainer account, or transitive dependency could therefore introduce arbitrary executable behavior. The referenced package and repository names are consistent with the documented browser automation project. The audited files do not demonstrate typosquatting, dependency confusion, or an existing malicious payload. The risk arises from the absence of immutable version pinning and integrity verification. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the upstream repository, or a relevant transitive dependency. 2. The attacker publishes a malicious release under the default or `latest ...[truncated 1160 chars]
• Remediation: ## Remediation Suggestions 1. Pin `agent-browser` to an exact, reviewed npm version rather than relying on the default release or `@latest`: ```bash npm install -g agent-browser@<reviewed-exact-version> ``` 2. For source installations, check out an immutable reviewed commit SHA: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout --detach <reviewed-commit-sha> ``` 3. Verify signed tags, release provenance, and published package integrity before installation. 4. Use a committed lockfile with frozen-lockfile installation for source builds so transitive dependency resolution cannot change silently. 5. Review package lifecycle and build scripts before execution. Where operationally possible, initially install dependencies with lifecycle scripts disabled and explicitly run only reviewed setup steps. 6. Execute installation and browser automation in a least-privileged container or sandbox without unnecessary secrets, host filesystem access, or elevated permissions. 7. Replace the `@latest` troubleshooting recommendation in `CONTRIBUTING.md` with a known-compatible exact version and document a controlled process for reviewing upgrades.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly documents commands for setting HTTP credentials and manipulating cookies/localStorage without any warning about secret handling, token exposure, or safe storage. In an agent context, this can normalize passing credentials on the command line and persisting sensitive session material where it may be logged, echoed, or reused unintentionally.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 95% confidence
• Finding: The skill documents saving and loading browser session state to a file, which can preserve cookies, tokens, and other authenticated state. Without warnings or safeguards, agents may create reusable authentication artifacts that enable account takeover or unauthorized session reuse if the file is exposed.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 96% confidence
• Finding: The authentication example encourages saving a logged-in session to auth.json and reloading it later, directly demonstrating persistence of authenticated state. In the context of an agent skill, this materially increases risk because it operationalizes credential/session reuse without discussing theft, replay, or cross-task leakage.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The documentation advertises screenshots, PDFs, and video recording that write artifacts to disk, but gives no warning that these files may capture sensitive page contents, credentials, or personal data. In an automated agent workflow, silent local persistence increases the risk of data leakage through leftover files, workspace sharing, or later exfiltration by other tools.

Static analysis

No suspicious patterns detected.