Agent Browser Clawdbot.Disabled

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:35 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward browser-automation helper, with disclosed but sensitive auth-state and cookie features that users should handle carefully.

Install only from the intended npm package/source, prefer a pinned reviewed version where possible, and treat auth state files, cookies, and storage output like passwords: do not commit them, share them, or print them unnecessarily, and delete them when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:194
• Finding: Unpinned Global Dependency Installation and Unverified Browser Downloads## Vulnerability Details **File Location**: `SKILL.md:194-196`; duplicated in `skills/agent-browser-clawdbot/SKILL.md:194-196` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium **Complete Code Snippet**: ```bash npm install -g agent-browser agent-browser install # Download Chromium agent-browser install --with-deps # Linux: + system deps ``` ### Technical Analysis The installation instructions globally install `agent-browser` without specifying an exact version or verifying package integrity. Consequently, the code installed depends on whichever package version the npm registry resolves when the command is executed. The subsequent installation commands download Chromium and may install Linux system dependencies. The project provides no lockfile, checksum, signature-verification procedure, expected registry configuration, or other mechanism for authenticating these downloaded components. Although the metadata identifies the intended upstream repository, that reference does not guarantee that the package and browser artifacts retrieved during installation correspond to an audited release. This creates a supply-chain trust boundary in which mutable third-party artifacts can execute installation logic and introduce additional components after the skill itself has been reviewed. ### Attack Path 1. An attacker compromises the resolved npm package, its publisher account, the registry distribution path, or a subsequently downloaded browser artifact. 2. The attacker publishes or substitutes a malicious version while retaining the expected package name. 3. A user follows the documented `npm install -g agent-browser` instruction without an exact version or integrity constraint. 4. npm installs the attacker-controlled package into the user's global environment and may execute package lifecycle scripts with the invoking user's privileges. 5. The user runs `agent-browser install` ...[truncated 1272 chars]
• Remediation: ## Remediation Suggestions 1. Pin `agent-browser` to a specific, reviewed version rather than resolving the latest mutable release: ```bash npm install -g agent-browser@EXACT_AUDITED_VERSION ``` 2. Publish and verify the expected npm integrity hash or signed provenance for the selected release. 3. Document the approved npm registry and reject unexpected registry overrides or similarly named packages. 4. Prefer a project-local installation with a committed lockfile over a global installation, where operationally feasible. 5. Pin the Chromium revision and publish authenticated checksums or signatures for downloaded browser artifacts. 6. Separate browser installation from operating-system dependency installation. Require explicit administrative approval before using `--with-deps`. 7. Perform installation in a sandbox, container, or otherwise isolated environment with minimal filesystem and credential access. 8. Disable or tightly control npm lifecycle scripts when compatible with the package installation process. 9. Keep the duplicate installation guidance in both `SKILL.md` files synchronized so that all copies receive the same hardening changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly exposes commands for reading cookies and storage and for saving/loading authenticated browser state, but it provides no warning that these artifacts may contain session tokens, CSRF secrets, or other credentials. In an agent-facing skill, this omission is dangerous because an agent may persist, inspect, or reuse sensitive session material without user awareness, increasing the risk of credential theft, cross-account access, or accidental leakage into logs and files.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs users to save and load browser auth state files, which commonly contain cookies, local/session storage, and other session artifacts that can enable account takeover if copied or reused. In an agent context, documenting this workflow without any warning about secure storage, scope, lifetime, or sharing increases the chance that sensitive session material will be persisted insecurely or exfiltrated via logs, artifacts, or shared workspaces.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents commands for reading and modifying cookies and browser storage without any caution about the sensitivity of these values. Cookies, tokens, and localStorage/sessionStorage entries often contain authentication or personal data, so exposing these capabilities in agent-facing instructions without guardrails can facilitate credential theft, privacy violations, or unsafe mutation of application state.

Static analysis

No suspicious patterns detected.