Agent Browser Shield

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:01 AM UTC
• Version: 1.1.0

Overview

This skill is coherent and not malicious, but it asks users to run a high-trust browser extension from mutable external sources without integrity verification.

Install only if you trust the extension publisher and are comfortable letting this extension mediate browser pages used by the agent. Prefer a dedicated browser profile with no unrelated logins, verify the extension source and release artifact before loading or uploading it, and avoid the Browserbase path unless you accept sending the extension package to that service.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:20

Finding

Unpinned Remote Browser Extension Is Retrieved and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–22, with execution and upload instructions at lines 37–45 and 73–82
Vulnerability Type: Remote payload retrieval and supply-chain exposure
Risk Level: High

Vulnerable Code

text

- **Hosted ZIP** (required for Path 2; also for Path 1 when pinning a specific
  build):
  `https://github.com/pixiebrix/agent-browser-shield/releases/latest/download/agent-browser-shield-extension.zip`

The downloaded payload is subsequently loaded into Chromium:

text

- **Unpacked (when pinning a build):** unzip
  `agent-browser-shield-extension.zip` to a stable directory (e.g.
  `~/.cache/agent-browser-shield/extension/`) and pass `--load-extension` and
  `--disable-extensions-except` in step 2.

text

--load-extension=/abs/path/to/extension
--disable-extensions-except=/abs/path/to/extension

The alternative Browserbase path also retrieves and uploads the same payload while installing an unpinned global npm dependency:

sh

npm install -g browse
export BROWSERBASE_API_KEY="…"   # same key used by openclaw browserbase setup
browse cloud extensions upload ./agent-browser-shield-extension.zip

Technical Analysis

The Skill instructs users to retrieve a browser extension through a mutable releases/latest URL and execute it as privileged Chromium extension code. The URL does not identify an immutable release version, artifact digest, or source commit. No SHA-256 checksum, trusted digital signature, reproducible-build procedure, or other integrity verification is provided.

Because the project contains only SKILL.md, the extension source, manifest.json, requested browser permissions, network destinations, and executable behavior cannot be audited locally. The effective code can therefore change after the Skill itself has been reviewed.

Browser extensions can inspect or alter web content according to their manifest perm ...[truncated 3343 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable releases/latest URL with an immutable, explicitly versioned release artifact tied to a specific source commit.
2. Publish a cryptographic digest, such as SHA-256, through a separately authenticated channel and require verification before extraction, upload, or browser loading.
3. Sign release artifacts with a trusted signing identity and document mandatory signature verification.
4. Include the extension source and manifest.json in the audited project, or link them to the exact immutable source revision used to build the distributed archive.
5. Document every requested browser permission, host permission, externally reachable endpoint, and data-retention behavior. Remove permissions not essential to the declared shielding functionality.
6. Use reproducible builds so reviewers can confirm that the distributed ZIP corresponds to the reviewed source.
7. Pin browse and other plugins or packages to reviewed versions with integrity metadata. Avoid global npm installation where possible; prefer a locked, isolated project environment with lifecycle scripts disabled unless required.
8. Verify archive structure and reject unexpected executable files, symlinks, path traversal entries, or manifests requesting permissions beyond an approved allowlist.
9. Use a dedicated browser profile containing no unrelated credentials or sessions. Restrict the CDP listener to loopback and prevent access by untrusted local processes or network peers.
10. For Browserbase, upload only a verified artifact and limit API-key privileges, project scope, logging exposure, and key lifetime.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Lines L073-L081 describe downloading the extension ZIP and uploading it to Browserbase, including use of BROWSERBASE_API_KEY. While the steps are operationally clear, the documentation does not disclose the privacy/integrity implication that the extension package is being transmitted to an external service.

Content

No source excerpt is available for this finding.