Agent Browser Disabled

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:11 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is mostly coherent, but it documents persistent authenticated browser state and broad page inspection features without enough safety guidance.

Install only if you trust the agent-browser npm package and are comfortable with a tool that can interact with authenticated web pages. Treat saved state files, screenshots, recordings, traces, cookies, storage dumps, and network logs as sensitive secrets; avoid using saved state for high-value accounts, restrict file permissions, and delete captured artifacts when finished. Prefer a pinned, reviewed package version and a sandboxed or disposable environment rather than a global latest-version install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned Global npm Package Installation and Installer Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 17-19 **Vulnerability Type**: Unpinned third-party dependency installation and execution **Risk Level**: Medium **Vulnerable Code**: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` ### Technical Analysis The installation instructions globally install `agent-browser` without specifying an exact, reviewed version. npm may therefore resolve the command to a package release that did not exist when this skill was audited. npm installation can execute package lifecycle scripts, and the subsequent `agent-browser install` commands execute code supplied by the installed package. The `--with-deps` operation may also install browser-related system dependencies. Its precise privileges depend on the operating system and environment, but it potentially has a broader effect than a project-local package installation. The finding is a supply-chain weakness rather than evidence that the currently referenced package is malicious. ### Attack Path 1. An attacker compromises the `agent-browser` npm package, one of its transitive dependencies, or the relevant publisher account. 2. The attacker publishes a malicious version that satisfies the unpinned package request. 3. A user follows the documented `npm install -g agent-browser` instruction. 4. npm downloads the uncontrolled version and may run attacker-controlled lifecycle scripts. 5. The user subsequently executes `agent-browser install` or `agent-browser install --with-deps`, providing another opportunity for attacker-controlled code to run. 6. The payload performs actions with the permissions of the invoking user and potentially affects global tooling or system dependencies. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the invoking user's privileges. The attacker could access files available to that account, steal browser or de ...[truncated 246 chars]
• Remediation: ## Remediation Suggestions - Pin `agent-browser` to an exact, reviewed version, for example `npm install -g agent-browser@<reviewed-version>`. - Prefer a project-local installation governed by a committed lockfile instead of a global installation. - Use `npm ci` for source-based installations so dependency resolution matches the reviewed lockfile. - Verify package provenance and integrity before installation, including the publisher, registry source, release signatures or attestations, and expected package hashes where available. - Review npm lifecycle scripts and the behavior of `agent-browser install` before execution. - Avoid `--with-deps` unless system dependencies are genuinely required. Document the packages and privileges it needs. - Run installation in a sandbox, container, or otherwise minimally privileged environment. - Establish a controlled dependency-update process in which new versions are reviewed and tested before the documented version is changed.

T08 · Insecure Dependencies

Warning

• Location: CONTRIBUTING.md:23
• Finding: Mutable Latest-Version Dependency Recommended for Issue Reproduction## Vulnerability Details **File Location**: `CONTRIBUTING.md`, lines 23-26 **Vulnerability Type**: Installation of a mutable, unreviewed latest package release **Risk Level**: Medium **Vulnerable Code**: ```markdown 1. Install the latest version ```bash npm install -g agent-browser@latest ``` ``` ### Technical Analysis The contribution guide explicitly directs users to install the mutable `latest` npm distribution tag globally. A distribution tag is controlled by the package publisher and may be reassigned to a new release at any time. Consequently, the command does not provide reproducible dependency resolution and can execute package content that was never reviewed with this skill. npm packages may define lifecycle scripts that execute during installation. Global installation also places the package in shared tooling locations rather than isolating it to the project. This does not establish that `agent-browser` is malicious; it creates an exploitable trust boundary if the package, publisher account, registry response, or dependency chain is compromised. ### Attack Path 1. An attacker compromises the npm publisher account, package, registry resolution path, or a transitive dependency. 2. The attacker publishes a malicious release and assigns the `latest` distribution tag to it. 3. A contributor follows the issue-reporting instructions and runs `npm install -g agent-browser@latest`. 4. npm retrieves the attacker-controlled release and may execute its installation lifecycle scripts. 5. The malicious package runs under the contributor's account and remains available as a globally installed command. 6. Later invocations of `agent-browser` can continue executing the compromised implementation until it is removed or replaced. ### Impact Assessment Exploitation could result in arbitrary code execution with the contributor's privileges, exposure of accessible source code and credentials, modification of globa ...[truncated 247 chars]
• Remediation: ## Remediation Suggestions - Replace `@latest` with an exact version that has been reviewed and tested. - Record the approved version in the contribution guide and update it only through a documented dependency-review process. - Prefer a local development dependency with a committed lockfile and invoke it through the project's package manager. - Verify npm provenance or attestations, package ownership, registry configuration, and integrity metadata before approving a release. - Perform package installation in a disposable, minimally privileged environment. - Do not recommend `sudo` or administrator execution for npm package installation. - For issue reproduction, require contributors to report their existing version first and only request an upgrade to a specific known-good version when necessary. - Document removal and incident-response steps for a suspected compromised global installation, including uninstalling the package, clearing relevant npm caches, rotating potentially exposed credentials, and inspecting the host for unauthorized changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents screenshots, PDFs, recordings, cookies, storage inspection, traces, and network request viewing without any caution that these outputs may capture credentials, personal data, session tokens, or internal application content. In a browser automation skill, these features materially increase the chance of collecting and exposing sensitive data during normal use.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly promotes saving and reloading browser session state for authentication flows but does not warn that the state file can contain sensitive cookies, tokens, and other authenticated artifacts. In an agent context, this can lead to accidental persistence, reuse, or exfiltration of active login material across tasks, users, or environments.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 95% confidence
• Finding: The documented state save/load capability enables session persistence, which can preserve authenticated cookies and storage across runs. Without strong guidance on handling these artifacts securely, agents or users may unintentionally create reusable authentication bundles that can be stolen or misapplied.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 95% confidence
• Finding: The example workflow normalizes reusing saved authenticated state in later sessions, which increases the likelihood that credentials or session tokens will be retained longer than necessary. In shared or agent-driven environments, such persisted state can enable unauthorized account access if copied, logged, or loaded into the wrong context.

Static analysis

No suspicious patterns detected.