Agent Browser

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:22 AM UTC
• Version: 0.2.0

Overview

The skill is a coherent browser-automation wrapper, but it needs review because it encourages reusable authenticated browser state and inline credentials without enough safety guidance.

Review before installing. Use test or low-privilege accounts when possible, avoid storing real authenticated state unless necessary, protect any state files like credentials, do not commit or share recordings/state files, and prefer a pinned or isolated install of the agent-browser CLI.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-18
Vulnerability Type: Supply-chain risk caused by an unpinned globally installed dependency
Risk Level: Medium

Complete Code Snippet:

bash

npm install -g agent-browser
agent-browser install
agent-browser install --with-deps

Technical Analysis

The documented installation procedure resolves agent-browser without specifying a reviewed version. The npm registry can therefore provide whichever release is current when the command runs. The package is installed globally, after which package-provided installation commands are executed.

The agent-browser install --with-deps command may also provision browser and system dependencies. If the npm package, maintainer account, release pipeline, or transitive dependency is compromised, malicious package lifecycle or installer logic could execute under the invoking user's account. The effective installed content can change after this Skill has been reviewed because no immutable version or integrity value is specified.

This is a supply-chain exposure rather than evidence that the current upstream package is malicious.

Attack Path

1. An attacker compromises the upstream npm package, its publisher account, release pipeline, or a dependency included by a future release.
2. The attacker publishes malicious content under the package version resolved by the unpinned installation command.
3. A user follows the Skill documentation and runs npm install -g agent-browser.
4. npm installs the compromised package globally and may execute package lifecycle scripts.
5. The user then invokes the package-controlled installer, potentially including agent-browser install --with-deps.
6. Malicious code executes with the permissions of the invoking user and accesses resources available to that account.

Impact Assessment

A successful supply-chain compromise could permit arbitrary local code exe ...[truncated 448 chars]

Remediation

View remediation

Remediation Suggestions

• Pin agent-browser to a specifically reviewed release, such as agent-browser@<audited-version>.
• Record and verify npm package integrity and provenance before installation.
• Prefer a project-local installation over a global installation where operationally possible.
• Run installation in a minimally privileged environment; do not use an elevated shell unless explicitly required and reviewed.
• Document the files, browser components, and system packages modified by install and install --with-deps.
• Require explicit user approval before provisioning system dependencies.
• For source installations, pin the repository to a reviewed commit and use a committed lockfile with immutable dependency resolution.

T08 · Insecure Dependencies

Warning

• Location: CONTRIBUTING.md:17

Finding

Mutable Latest-Version Dependency Recommended During Issue Reproduction

Content

View full analysis

Vulnerability Details

File Location: CONTRIBUTING.md, lines 17-20
Vulnerability Type: Supply-chain risk caused by explicitly installing a mutable latest package release
Risk Level: Medium

Complete Code Snippet:

markdown

1. Install the latest version
   ```bash
   npm install -g agent-browser@latest
   ```

Technical Analysis

The contribution guide explicitly directs users to install the mutable latest npm distribution tag globally. The release selected by this tag can change independently of the audited project contents. Consequently, a contributor attempting to reproduce an issue may install and execute package content that did not exist when the Skill was reviewed.

npm packages can contain lifecycle scripts that run during installation. If a future release, publisher account, build pipeline, or dependency is compromised, use of @latest provides a direct delivery route to contributors' machines. The global installation scope also makes the resulting executable available beyond the immediate project directory.

This finding identifies an unsafe dependency-management practice; it does not establish that the currently published package is malicious.

Attack Path

1. An attacker gains the ability to publish or influence a malicious agent-browser release or one of its dependencies.
2. The compromised release is assigned to the npm latest distribution tag.
3. A contributor follows the issue-reporting instructions and executes npm install -g agent-browser@latest.
4. npm downloads the attacker-controlled release and may execute its lifecycle scripts.
5. The malicious code operates with the contributor's current account privileges and can access locally available data and resources.

Impact Assessment

Exploitation could result in arbitrary command execution under the contributor's account. Accessible scope may include source repositories, SSH or package-registry credential ...[truncated 260 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an explicitly reviewed and pinned package version.
• Provide a known-good version for issue reproduction so results remain deterministic.
• Verify package provenance and integrity before installation.
• Prefer a local, isolated development dependency or disposable environment instead of a global installation.
• Disable or separately review package lifecycle scripts where practical.
• Document that installation must run with least privilege and should not be performed using an administrator or root account.
• Establish a controlled dependency-update process that reviews new releases before changing the documented version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The recording section notes that a fresh context preserves cookies and storage from the current session, but it does not warn that recordings and the reused session context may capture authenticated activity or sensitive data. This can lead operators or agents to create sharable demo artifacts that expose account data, tokens, or privileged workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill documents setting custom headers and HTTP basic-auth credentials without warning that these values are secrets that may be exposed in shell history, process listings, logs, screenshots, or shared transcripts. In agent-operated environments, this creates a realistic risk of credential leakage and unintended reuse across sites or sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly documents saving and reusing authenticated browser state but gives no warning that the saved file may contain cookies, tokens, and other session artifacts that can impersonate a user. In an agent context, this increases the chance that state files are stored insecurely, reused across tasks, or exfiltrated through logs, artifacts, or shared workspaces.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

Saving and loading browser session state enables persistence of authenticated sessions across runs, which can be dangerous if the state file is copied, logged, or left in a shared environment. Anyone with access to that file may be able to replay the authenticated session without knowing the original credentials.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash

agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The example encourages later reuse of saved authenticated state without any guardrails about ownership, expiry, or storage hygiene. In an automation skill used by agents, this can normalize insecure token persistence and cross-task account access if the same workspace or artifacts are reused.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Static analysis

No suspicious patterns detected.