agent-browser

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:34 AM UTC
• Version: 0.2.0

Overview

This skill is a documented browser automation wrapper with no bundled executable code, but users should handle saved browser state and unpinned installs carefully.

Install only from a trusted version of agent-browser, prefer a pinned package version or reviewed commit, and avoid running install commands with elevated privileges. Treat saved state files, cookies, storage dumps, screenshots, videos, PDFs, and traces as sensitive because they can contain account sessions or private page data; delete them when no longer needed and do not commit or share them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned Third-Party Dependencies and Mutable Installation Sources## Vulnerability Details **File Location**: `SKILL.md:17-32`; `CONTRIBUTING.md:21-25` **Vulnerability Type**: Unpinned third-party package and source installations **Risk Level**: Medium ### Vulnerable Code `SKILL.md:17-32`: ```bash ### npm recommended ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` ### From Source ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build agent-browser install ``` ``` `CONTRIBUTING.md:21-25`: ```bash ## Before Opening an Issue 1. Install the latest version ```bash npm install -g agent-browser@latest ``` ``` ### Technical Analysis The installation instructions retrieve and install mutable third-party content without pinning an audited package version, dependency lock state, release digest, or Git commit. The explicit use of `@latest` guarantees that installation behavior can change over time without any corresponding change to this skill package. The source installation path clones the default branch and runs `pnpm install` and `pnpm build`. Consequently, both upstream repository content and transitive package dependencies may differ from the content that existed when this skill was reviewed. Package lifecycle scripts can execute local commands during installation. The `agent-browser install --with-deps` operation may also install browser and operating-system dependencies, increasing the potential system impact and possibly requiring elevated privileges depending on the environment. No evidence indicates that the currently named upstream package or repository is malicious. The vulnerability is the absence of controls that ensure users receive the same dependency content that was audited. ### Attack Path 1. An attacker compromises the upstream npm package, its maintainer account, the source repository, or a transitive dependency. 2. The attack ...[truncated 1569 chars]
• Remediation: ## Remediation Suggestions 1. Pin `agent-browser` to a specific reviewed version instead of using an implicit current version or `@latest`, for example: ```bash npm install -g agent-browser@<reviewed-version> ``` 2. Publish and verify the expected package integrity digest or signed release provenance before installation. 3. For source installations, check out a reviewed immutable commit or signed release tag: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout <reviewed-commit-sha> ``` 4. Use a committed lockfile and frozen dependency installation, such as `pnpm install --frozen-lockfile`, to prevent silent transitive dependency changes. 5. Prefer a project-local installation over a global installation to reduce the affected scope and avoid changing shared tools. 6. Document whether `agent-browser install --with-deps` requires elevated privileges. Recommend running untrusted package installation without administrative privileges and installing reviewed system dependencies separately. 7. Disable package lifecycle scripts where feasible during dependency retrieval, then explicitly run only reviewed build or setup steps. 8. Establish a dependency update process that reviews new versions, regenerates integrity metadata, and updates the pinned version only after security validation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documented commands allow setting HTTP credentials and reading/modifying cookies and localStorage without any guidance on sensitive-data handling. In a browser automation skill used by agents, these features can expose secrets, session tokens, and user data to logs, transcripts, or downstream tools if operators are not warned to treat them as sensitive.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly documents saving and loading browser session state (e.g. auth.json) but does not warn that this can persist authentication cookies, tokens, and other session artifacts to disk. In an agent context, that creates a realistic risk of credential/session leakage via local files, reuse across tasks, or accidental inclusion in logs, artifacts, or version control.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 94% confidence
• Finding: The state save/load commands enable session persistence across runs, which can preserve active authentication and tracking state. Without warnings or safeguards, an agent or user may reuse sensitive sessions unintentionally, enabling account misuse or leakage if the saved file is accessed by other processes or users.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 95% confidence
• Finding: The authentication example normalizes loading previously saved authenticated state for later sessions, but does not mention the security implications of storing reusable auth artifacts. This makes unsafe persistence seem routine in an agent workflow, increasing the chance of token theft, unintended cross-task access, or accidental distribution of session files.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill describes saving screenshots, PDFs, videos, and traces to local files without warning that these artifacts may capture sensitive page content, personal data, or tokens visible in the UI. In agent-driven workflows, such files may be retained, shared, or uploaded automatically, increasing unintended data exposure risk.

Static analysis

No suspicious patterns detected.