Agent Browser Conflict

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:07 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is mostly coherent, but it asks users to install a mutable global CLI and documents reusable authenticated browser state without enough safety guidance.

Review before installing. Use this only in an isolated workspace or disposable environment, pin and verify the agent-browser package version if possible, avoid running --with-deps with elevated privileges unless you understand the host changes, and treat saved state files such as auth.json as credentials: do not commit, share, or reuse them across unrelated tasks, and delete them when finished.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly documents saving and loading authenticated browser state without warning that session files can contain cookies, tokens, and other credentials. In an agent context, this can lead to accidental persistence, reuse, or exfiltration of sensitive authentication material across tasks or users.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

State save/load features enable session persistence, which can preserve authenticated cookies and local storage across runs. In an agent environment, this increases the risk of credential replay, cross-task contamination, and unauthorized access if the state file is exposed or reused improperly.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash

agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The example normalizes reusing a saved authenticated state file (auth.json) across later sessions without any warning about secret handling. That makes unsafe persistence more likely in practice, especially for autonomous agents that may store artifacts in shared workspaces or logs.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill description advertises saving screenshots and PDFs to local paths such as path.png and output.pdf, which can modify the local filesystem. Although this behavior is part of the tool's purpose, the markdown does not include any caution about choosing safe output paths or avoiding accidental overwrites.

Content

No source excerpt is available for this finding.