Agent Browser

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:50 AM UTC
• Version: 1.0.0

Overview

This is a coherent browser automation skill, but it needs Review because it normalizes persistent authenticated browser state and mutable global installation without enough safety guidance.

Install only if you trust the agent-browser package/source you are installing, prefer pinned versions or audited commits, avoid running installation with elevated privileges, and treat auth.json, screenshots, PDFs, videos, traces, cookies, storage, and network logs as sensitive secrets that should not be committed or shared and should be deleted when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15
• Finding: Unpinned Third-Party Package and Source Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15-26`; `CONTRIBUTING.md:15-17` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:15-17`: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` `SKILL.md:23-26`: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build ``` `CONTRIBUTING.md:15-17`: ```bash npm install -g agent-browser@latest ``` ### Technical Analysis The installation instructions retrieve and execute third-party software without pinning an audited package version, source commit, dependency lock state, or artifact integrity value. The npm commands install either the registry's current default release or explicitly use the mutable `latest` tag. A future release can therefore differ from the version reviewed when this skill was published. npm installation can execute package lifecycle scripts with the privileges of the invoking user. The source installation workflow clones the current repository HEAD and resolves packages through `pnpm install`. No audited commit hash, signed tag, or frozen lockfile requirement is specified. The effective code and transitive dependency graph can consequently change after review. The subsequent `agent-browser install` commands retrieve additional browser components. The `--with-deps` variant may also install operating-system dependencies and can cause broader system modification when the user supplies elevated privileges. The documentation does not require checksum or signature verification for these retrieved components. ### Attack Path 1. An attacker compromises the upstream npm package, its maintainer account, the source repository, a transitive dependency, or a downloaded browser artifact. 2. The attacker publishes malicious content under the package's default release or `latest` tag, changes repository HEAD, or substitutes ...[truncated 1137 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the npm package to a specific, audited version rather than using an implicit current release or `@latest`: ```bash npm install -g agent-browser@<audited-version> ``` 2. Record and verify npm integrity metadata or package provenance before installation. 3. Pin source installations to an audited commit: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout --detach <audited-commit-sha> ``` 4. Require signature verification for signed releases or tags where upstream supports it. 5. Commit and review a dependency lockfile, then require a frozen installation mode such as: ```bash pnpm install --frozen-lockfile ``` 6. Publish expected cryptographic checksums for browser binaries and other downloaded artifacts, and verify them before execution. 7. Prefer a local, isolated installation or sandbox over a global package installation. 8. Warn users not to run installation as root or with administrative privileges unless strictly necessary. Review system dependencies before using `--with-deps`. 9. Establish a controlled update process in which package versions, source commits, lockfiles, and downloaded artifacts are re-audited before documentation is updated. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents saving screenshots, PDFs, videos, traces, and session artifacts but does not warn that these outputs can capture sensitive page contents, authenticated views, tokens in URLs, or reusable browser/session material. In an agent context, users may run these commands against internal or logged-in applications, causing confidential data to be written to disk or shared downstream without realizing the exposure.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The authentication and saved-state examples normalize writing session state to a file without warning that such files may contain reusable authenticated session material. If an agent or user stores or transfers auth.json insecurely, another party could replay the session and gain unauthorized access to the target application.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 92% confidence
• Finding: The documented ability to save and later load browser session state enables persistence of authenticated sessions across runs. Without guardrails or warnings, this can facilitate credential/session reuse, accidental long-term retention of access, and compromise if the state file is exposed to other users, agents, or processes.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 94% confidence
• Finding: The example explicitly encourages loading previously saved authenticated state in later sessions, which increases the chance that reusable session material will be retained and replayed. In the context of an automation skill for agents, this is particularly dangerous because agents may handle multiple tasks, users, or environments and could unintentionally apply persisted auth to the wrong workflow or leak it via shared storage.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The natural-language description at L03 is Chinese-only, while the rest of the manifest includes English triggers and does not state that the skill is intended exclusively for Chinese-speaking users or a region-specific context. This can amount to a language-policy issue because it imposes a locale on users without opt-in or justification.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad phrases such as 'browser automation', 'web scraping', and generic browsing terms that can match many unrelated user requests. In an agent environment, this can cause the skill to activate outside its narrow intended scope, increasing the chance of unintended web actions, data access, or overlap with safer/more specific skills.

Static analysis

No suspicious patterns detected.