自我智能改进体

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 1.0.0

Overview

This browser-automation skill is coherent, but it asks users to handle live browser sessions and install mutable global tooling without enough safety guidance.

Review this before installing. Use it only in an isolated environment, avoid loading real admin sessions unless necessary, treat saved auth JSON, cookies, and storage values as secrets, delete them after use, and prefer a pinned local install over the documented global npm install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:197

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 197–199
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

npm install -g agent-browser
agent-browser install                     # Download Chromium
agent-browser install --with-deps         # Linux: + system deps

Technical Analysis

The installation instructions globally install agent-browser without specifying an exact package version or integrity hash. Consequently, the installed content depends on whichever release the npm registry resolves at installation time, rather than a version reviewed with this skill.

An npm installation may execute package lifecycle scripts. After installation, the instructions invoke the package to download Chromium and, with --with-deps, install additional system dependencies. This expands the trust boundary from the skill itself to the current npm package release, its transitive dependencies, browser artifacts, and system-package sources.

The audit found no evidence that the currently named package is malicious. The issue is that package takeover, registry compromise, or a malicious future release could alter the effective code after this skill has been reviewed.

Attack Path

1. An attacker compromises the agent-browser npm package, its maintainer account, a transitive dependency, or the relevant distribution channel.
2. The attacker publishes a malicious release or causes dependency resolution to select malicious content.
3. A user follows the documented npm install -g agent-browser command.
4. npm retrieves the mutable package version and may execute attacker-controlled lifecycle code during installation.
5. Because installation is global, malicious content can affect the shared command environment. If installation or --with-deps is run with elevated privileges, the payload may inherit those privileges.
6. The user then invokes `agent-browser install ...[truncated 856 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin agent-browser to an exact reviewed version rather than allowing npm to resolve the latest release.
2. Record and verify package integrity using a lockfile and registry-provided integrity metadata.
3. Prefer a project-local installation over npm install -g to limit the package's scope and make dependency resolution reproducible.
4. Review the selected package version, transitive dependency tree, and lifecycle scripts before installation.
5. Disable lifecycle scripts during installation where compatible, and run any required setup step separately after review.
6. Execute installation as an unprivileged, isolated user or inside a disposable container or sandbox.
7. Pin and verify downloaded Chromium artifacts and document the trusted download source.
8. Avoid --with-deps unless necessary. When system dependencies are required, list and install reviewed, version-controlled packages through the operating system's trusted package-management process.
9. Add package provenance or signature verification and routine dependency vulnerability scanning to the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly documents saving and loading browser auth state, as well as reading and modifying cookies and local storage, but provides no warning that these artifacts may contain active session tokens, authentication cookies, or other sensitive credentials. In an agent context, this increases the risk of credential reuse, accidental exfiltration, insecure storage, or cross-session privilege leakage if operators treat these files and commands as routine automation outputs.

Content

No source excerpt is available for this finding.