Agent Browser Clawdbot Rose

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:37 AM UTC
• Version: 1.0.0

Overview

This is a coherent browser-automation helper skill, but users should treat saved browser sessions, cookies, and global installation steps carefully.

Install only from a trusted registry/source, consider pinning the package version, and avoid running dependency installation with elevated privileges unless needed. Treat saved auth-state files, cookies, and storage values like secrets: keep them out of source control, use test or least-privilege accounts where possible, and delete stale session files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:194
• Finding: Unpinned Global npm Package Installation Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 194–198 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash ## Installation ```bash npm install -g agent-browser agent-browser install # Download Chromium agent-browser install --with-deps # Linux: + system deps ``` ### Technical Analysis The documented installation process globally installs `agent-browser` without pinning an exact version or verifying package integrity. The installed package and its transitive dependencies therefore depend on the versions supplied by the npm registry at installation time. npm package installation may execute package lifecycle scripts with the invoking user's privileges. The subsequent `agent-browser install` command downloads Chromium, while `agent-browser install --with-deps` may install or modify operating-system dependencies. The artifact references a plausible upstream GitHub repository, but it does not cryptographically bind the installed npm artifact to reviewed source code or a known integrity hash. This is a supply-chain weakness rather than evidence that the current package is malicious. Exploitation would require compromise or substitution of the package, a maintainer account, a transitive dependency, or the relevant registry response. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, a transitive dependency, or the package delivery channel. 2. The attacker publishes or causes resolution of a release containing a malicious lifecycle script or installer payload. 3. A user follows the documented `npm install -g agent-browser` command. 4. npm resolves the attacker-controlled current package or dependency because no exact version or integrity value is specified. 5. Malicious installation code executes with the privileges of the invoking user. 6. The subsequent browser or system-dependency ...[truncated 686 chars]
• Remediation: ## Remediation Suggestions 1. Pin `agent-browser` to an exact reviewed version rather than installing the current registry release. 2. Use a project-local, lockfile-backed dependency installation instead of a global installation where feasible. 3. Record and verify the expected package integrity hash and provenance. 4. Review the pinned package, transitive dependency tree, lifecycle scripts, and Chromium installer before deployment. 5. Use `npm install --ignore-scripts` where operationally compatible, and run any required installation scripts separately only after review. 6. Avoid `--with-deps` and elevated privileges unless system dependencies are explicitly required and their changes have been reviewed. 7. Perform installation in a sandbox, container, or otherwise least-privileged environment. 8. Document the trusted registry and validate that the npm artifact corresponds to the stated upstream source and release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly instructs users to save and load browser authentication state, which typically contains cookies and local/session storage that can preserve active sessions or other sensitive credentials. In an AI-agent context, documenting this workflow without any warning about secure storage, scope limitation, and reuse risks increases the chance of accidental credential leakage or session hijacking.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill exposes commands for reading and modifying cookies and browser storage but provides no privacy or security guidance. Because these mechanisms commonly hold session tokens, CSRF material, and user data, an agent following this documentation could exfiltrate or tamper with sensitive state, especially in automated or multi-tenant environments.

Static analysis

No suspicious patterns detected.