Agent Browser Skipped

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:18 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent browser-automation wrapper, but it under-explains high-impact session, credential, capture, and mutable-install risks that users should review before installing.

Install only if you trust the agent-browser package/source and are comfortable giving an agent browser-control authority. Avoid using saved session files, cookie/storage inspection, screenshots, recordings, traces, or network logs on sensitive accounts unless necessary; treat auth.json and capture artifacts as secrets and delete them when done. Prefer pinned, reviewed versions and isolated environments over global latest installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Installation and Mutable Source Build

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-28; CONTRIBUTING.md:21
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:16-18:

bash

npm install -g agent-browser
agent-browser install
agent-browser install --with-deps

SKILL.md:24-28:

bash

git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
pnpm install
pnpm build
agent-browser install

CONTRIBUTING.md:21:

bash

npm install -g agent-browser@latest

Technical Analysis

The installation instructions retrieve and execute third-party software without pinning an audited npm package version or immutable source commit. The source installation workflow clones the mutable default branch of the upstream repository and resolves dependencies at installation time. No checksum, cryptographic signature, lockfile verification, or frozen dependency installation is required.

A global npm installation can execute package lifecycle scripts controlled by the downloaded package. The subsequent agent-browser install commands also execute installed third-party code. The --with-deps option may invoke operating-system package management and could be run with elevated privileges, increasing the potential impact.

The recommendation to install agent-browser@latest explicitly selects a mutable release target. Consequently, code reviewed at one point in time may differ from the code downloaded by a user later.

Attack Path

1. An attacker compromises the upstream npm package, source repository, maintainer account, release process, or a dependency resolved during installation.
2. The attacker publishes a malicious package release, changes the repository's default branch, or introduces a malicious transitive dependency.
3. A user or agent follows the documented installation instructions.
4. npm or pnpm downloads the attacker-controlled ...[truncated 961 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin agent-browser to a specific, audited npm version instead of using an unversioned package or @latest.
2. For source installations, pin an immutable Git commit or signed release tag and document the expected commit identifier.
3. Publish and verify cryptographic checksums or signatures for downloaded release artifacts.
4. Commit a reviewed dependency lockfile and require frozen or immutable dependency installation, such as pnpm install --frozen-lockfile.
5. Disable package lifecycle scripts where feasible, or explicitly review all scripts before allowing execution.
6. Avoid global installation when possible; prefer a project-local, isolated, or containerized installation.
7. Document whether --with-deps requires elevated privileges and instruct users not to grant administrative access unless strictly necessary.
8. Run installation and browser setup in a sandbox or restricted environment with minimal filesystem, credential, and network access.
9. Establish a dependency update process in which new versions and source commits are reviewed before documentation pins are changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises screenshots, PDF export, video recording, tracing, console viewing, error capture, and network request inspection without warning that these outputs can contain page contents, PII, credentials, tokens, internal URLs, or debugging secrets. Because the skill is designed for autonomous browser automation, these capture features can easily collect and persist sensitive data from authenticated sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly documents commands for setting HTTP credentials, reading and modifying cookies, and reading/writing localStorage, plus saving and loading session state, without any warning that these operations expose authentication material and can persist secrets to disk. In an agent context, these features materially increase the chance of credential theft, session hijacking, or accidental long-term retention of sensitive tokens if the agent is directed to inspect or export browser state.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The documented ability to save and later load browser session state enables persistent reuse of authenticated sessions. Without warnings or constraints, this can preserve cookies and tokens on disk, allowing session replay or unauthorized access if the file is exposed, reused across tasks, or handled by an untrusted agent workflow.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash

agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The authentication example normalizes saving login state to auth.json and reusing it in later sessions, but does not warn that this file effectively functions like a bearer token container. In agent-operated environments, this makes accidental leakage, cross-task reuse, or theft of active session material more likely.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text