Agent Browser Conflict

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:07 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is mostly coherent, but it asks users to install a mutable global CLI and documents reusable authenticated browser state without enough safety guidance.

Review before installing. Use this only in an isolated workspace or disposable environment, pin and verify the agent-browser package version if possible, avoid running --with-deps with elevated privileges unless you understand the host changes, and treat saved state files such as auth.json as credentials: do not commit, share, or reuse them across unrelated tasks, and delete them when finished.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12
• Finding: Unpinned Global Installation of a Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:12-17`; additional occurrence at `CONTRIBUTING.md:18-22` **Vulnerability Type**: Unpinned and mutable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:12-17`: ```bash ### npm recommended ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` `CONTRIBUTING.md:18-22`: ```bash 1. Install the latest version ```bash npm install -g agent-browser@latest ``` ``` ### Technical Analysis The installation instructions direct users to install `agent-browser` globally without pinning an exact reviewed version. The contributing guide explicitly requests the mutable `@latest` release. Consequently, the code users install can differ from the version that existed when this Skill was audited. npm packages may execute lifecycle scripts during installation. A global installation also places package executables and files into shared user-level or system-level npm locations. In addition, the subsequent `agent-browser install --with-deps` command may download browser components and install operating-system dependencies, expanding the supply-chain and host-modification surface. The repository provides no lockfile, package integrity hash, release signature, provenance verification procedure, or exact version constraint. This does not prove that the current upstream package is malicious, but it creates an unsafe dependency acquisition path in which an upstream account compromise, registry compromise, or malicious future release could result in local code execution. ### Attack Path 1. An attacker compromises the upstream npm publisher account, release process, or package distribution channel. 2. The attacker publishes a malicious release under the legitimate `agent-browser` package name and assigns it the `latest` tag. 3. A user follows the documented `npm install -g agent-browser` or `npm install -g agent-browser@latest` ins ...[truncated 1128 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact version that has been reviewed, for example: ```bash npm install -g agent-browser@X.Y.Z ``` 2. Remove instructions that use `@latest` or otherwise resolve a mutable version. 3. Publish the expected npm package integrity digest and document how users can verify package provenance before installation. 4. Prefer a project-local installation with a committed lockfile over global installation: ```bash npm install --save-exact agent-browser@X.Y.Z npx agent-browser install ``` 5. Use npm provenance attestations or signed release artifacts where available, and verify that the package publisher and repository match the expected upstream project. 6. Review package lifecycle scripts and consider installation with lifecycle scripts disabled when compatible: ```bash npm install --ignore-scripts --save-exact agent-browser@X.Y.Z ``` 7. Treat `--with-deps` as a privileged host-modification operation. Document the exact system packages it installs, require explicit user approval, and recommend running it only in a disposable container or isolated environment. 8. Establish a controlled dependency-update process in which new versions are reviewed and tested before the pinned version in the documentation is changed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly documents saving and loading authenticated browser state without warning that session files can contain cookies, tokens, and other credentials. In an agent context, this can lead to accidental persistence, reuse, or exfiltration of sensitive authentication material across tasks or users.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 91% confidence
• Finding: State save/load features enable session persistence, which can preserve authenticated cookies and local storage across runs. In an agent environment, this increases the risk of credential replay, cross-task contamination, and unauthorized access if the state file is exposed or reused improperly.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 94% confidence
• Finding: The example normalizes reusing a saved authenticated state file (`auth.json`) across later sessions without any warning about secret handling. That makes unsafe persistence more likely in practice, especially for autonomous agents that may store artifacts in shared workspaces or logs.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The skill description advertises saving screenshots and PDFs to local paths such as `path.png` and `output.pdf`, which can modify the local filesystem. Although this behavior is part of the tool's purpose, the markdown does not include any caution about choosing safe output paths or avoiding accidental overwrites.

Static analysis

No suspicious patterns detected.