Agent Browser Skipped

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:18 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent browser-automation wrapper, but it under-explains high-impact session, credential, capture, and mutable-install risks that users should review before installing.

Install only if you trust the agent-browser package/source and are comfortable giving an agent browser-control authority. Avoid using saved session files, cookie/storage inspection, screenshots, recordings, traces, or network logs on sensitive accounts unless necessary; treat auth.json and capture artifacts as secrets and delete them when done. Prefer pinned, reviewed versions and isolated environments over global latest installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16
• Finding: Unpinned Third-Party Installation and Mutable Source Build## Vulnerability Details **File Location**: `SKILL.md:16-28`; `CONTRIBUTING.md:21` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:16-18`: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` `SKILL.md:24-28`: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build agent-browser install ``` `CONTRIBUTING.md:21`: ```bash npm install -g agent-browser@latest ``` ### Technical Analysis The installation instructions retrieve and execute third-party software without pinning an audited npm package version or immutable source commit. The source installation workflow clones the mutable default branch of the upstream repository and resolves dependencies at installation time. No checksum, cryptographic signature, lockfile verification, or frozen dependency installation is required. A global npm installation can execute package lifecycle scripts controlled by the downloaded package. The subsequent `agent-browser install` commands also execute installed third-party code. The `--with-deps` option may invoke operating-system package management and could be run with elevated privileges, increasing the potential impact. The recommendation to install `agent-browser@latest` explicitly selects a mutable release target. Consequently, code reviewed at one point in time may differ from the code downloaded by a user later. ### Attack Path 1. An attacker compromises the upstream npm package, source repository, maintainer account, release process, or a dependency resolved during installation. 2. The attacker publishes a malicious package release, changes the repository's default branch, or introduces a malicious transitive dependency. 3. A user or agent follows the documented installation instructions. 4. npm or pnpm downloads the attacker-controlled ...[truncated 961 chars]
• Remediation: ## Remediation Suggestions 1. Pin `agent-browser` to a specific, audited npm version instead of using an unversioned package or `@latest`. 2. For source installations, pin an immutable Git commit or signed release tag and document the expected commit identifier. 3. Publish and verify cryptographic checksums or signatures for downloaded release artifacts. 4. Commit a reviewed dependency lockfile and require frozen or immutable dependency installation, such as `pnpm install --frozen-lockfile`. 5. Disable package lifecycle scripts where feasible, or explicitly review all scripts before allowing execution. 6. Avoid global installation when possible; prefer a project-local, isolated, or containerized installation. 7. Document whether `--with-deps` requires elevated privileges and instruct users not to grant administrative access unless strictly necessary. 8. Run installation and browser setup in a sandbox or restricted environment with minimal filesystem, credential, and network access. 9. Establish a dependency update process in which new versions and source commits are reviewed before documentation pins are changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill advertises screenshots, PDF export, video recording, tracing, console viewing, error capture, and network request inspection without warning that these outputs can contain page contents, PII, credentials, tokens, internal URLs, or debugging secrets. Because the skill is designed for autonomous browser automation, these capture features can easily collect and persist sensitive data from authenticated sessions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly documents commands for setting HTTP credentials, reading and modifying cookies, and reading/writing localStorage, plus saving and loading session state, without any warning that these operations expose authentication material and can persist secrets to disk. In an agent context, these features materially increase the chance of credential theft, session hijacking, or accidental long-term retention of sensitive tokens if the agent is directed to inspect or export browser state.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 90% confidence
• Finding: The documented ability to save and later load browser session state enables persistent reuse of authenticated sessions. Without warnings or constraints, this can preserve cookies and tokens on disk, allowing session replay or unauthorized access if the file is exposed, reused across tasks, or handled by an untrusted agent workflow.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 93% confidence
• Finding: The authentication example normalizes saving login state to auth.json and reusing it in later sessions, but does not warn that this file effectively functions like a bearer token container. In agent-operated environments, this makes accidental leakage, cross-task reuse, or theft of active session material more likely.

Static analysis

No suspicious patterns detected.