Agent Browser Core.Bak

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

This skill is a documentation-only playbook for browser automation and its sensitive capabilities are disclosed with safety guardrails.

Before installing, pin the exact agent-browser version, prefer a container or dedicated environment, and avoid the unpinned `npx playwright install-deps chromium` fallback unless you accept the package-resolution risk. Treat browser profiles, saved state, cookies, and credentials as secrets, and require explicit approval for eval, file access, proxies, network interception, or persistent state reuse.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/agent-browser-overview.md:15

Finding

Unpinned Third-Party Package Retrieval and Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: references/agent-browser-overview.md, lines 15–17
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code:

markdown

- Linux dependencies (if needed):
  - `agent-browser install --with-deps`
  - or `npx playwright install-deps chromium`

Technical Analysis

The documented fallback command invokes playwright through npx without specifying an exact, audited version. If the package is not already available locally, npx may resolve, download, and execute package code from the configured package registry.

The project provides no lockfile, integrity hash, verified artifact source, or exact approved Playwright version for this operation. Consequently, the code executed by this instruction can change after the Skill has been reviewed. This creates supply-chain exposure to a compromised registry account, package replacement, malicious registry configuration, or an unexpectedly unsafe future release.

The command is particularly sensitive because install-deps is intended to install browser-related operating-system dependencies. Depending on the host configuration and how the command is invoked, it may cause substantial system changes or request elevated privileges.

Attack Path

1. A user follows the Linux setup instructions in the Skill.
2. The user runs npx playwright install-deps chromium.
3. npx fails to find an approved local package and resolves playwright through the configured registry without an exact version constraint.
4. The registry supplies a compromised, substituted, or unexpectedly changed package version.
5. Package lifecycle logic or the resolved CLI executes with the invoking user's privileges.
6. Malicious package code can access data available to that user, modify the environment, or abuse any elevated privileges granted during dependency installation.

Successful exploitation depends on compromise or manipulation of the p ...[truncated 781 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unversioned command with an exact, previously audited Playwright version.
2. Manage Playwright through a project manifest and committed lockfile containing package integrity metadata.
3. Install dependencies from the verified official registry and enforce the expected registry configuration.
4. Invoke the lockfile-resolved local binary rather than allowing npx to select an arbitrary current package version.
5. Use reproducible installation controls such as npm ci and disable unnecessary package lifecycle scripts where operationally feasible.
6. Verify package provenance or signatures when supported, and review dependency changes before upgrading.
7. Perform browser and operating-system dependency installation inside an isolated container or disposable environment without credentials.
8. Do not run the package retrieval step with elevated privileges. If system packages require elevation, separate and review the exact operating-system package installation operation.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The documentation recommends npx playwright install-deps chromium, which invokes a package without pinning an exact version. If a newer or compromised package version is resolved at execution time, users may run unintended code during dependency installation, which is especially relevant because this toolchain is explicitly described as high privilege browser automation.

Content

No source excerpt is available for this finding.