Agent Browser Core.Conflict

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed browser-automation guide with reasonable safety guardrails, though users should avoid its unpinned optional npx setup command unless they pin the package version.

Install only in a dedicated environment, pin exact package versions, prefer agent-browser install or a lockfile-controlled local Playwright binary over unpinned npx, avoid elevated privileges, and use the documented approval checks before handling credentials, browser state, downloads, local files, eval, proxying, or network interception.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/agent-browser-overview.md:17

Finding

Unpinned Package Retrieval and Execution via npx

Content

View full analysis

Vulnerability Details

File Location: references/agent-browser-overview.md, line 17
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code Snippet

markdown

- Linux dependencies (if needed):
  - `agent-browser install --with-deps`
  - or `npx playwright install-deps chromium`

Technical Analysis

The documented npx playwright install-deps chromium command does not specify an exact Playwright version. If Playwright is unavailable locally, npx can retrieve and execute the currently resolved package from the configured npm registry.

This creates a mutable supply-chain execution path: the package executed when a user follows the instructions may differ from the package available when the skill was audited. A compromised upstream release, registry account, registry configuration, or package-resolution environment could therefore cause attacker-controlled package code to execute locally.

The command is particularly sensitive because install-deps installs operating-system dependencies and may prompt users to authorize elevated operations. Although the surrounding documentation advises users not to run with elevated privileges, the command itself does not provide integrity verification or enforce isolation.

Attack Path

1. An attacker compromises a relevant npm publisher, release process, registry, or package-resolution environment.
2. A malicious or unexpectedly altered Playwright version becomes the version resolved by the unpinned npx playwright invocation.
3. A user follows the setup instructions on a Linux host.
4. npx downloads and executes package-controlled code.
5. The malicious package runs with the invoking user's privileges and may leverage any elevation the user grants during dependency installation.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user invoking npx. This could permit access to that u ...[truncated 401 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the command with an exact, reviewed version, for example:

  bash

  npx --yes playwright@<audited-exact-version> install-deps chromium
  

• Prefer installing from a lockfile-controlled project dependency and invoking the already installed local binary rather than allowing on-demand package resolution.

• Configure npm to use a trusted registry and verify package provenance and integrity before execution.

• Review and deliberately update the pinned version instead of automatically tracking the latest release.

• Run installation inside a dedicated container, virtual machine, or otherwise isolated environment.

• Use a non-privileged account and do not grant administrative privileges unless the exact system-level operations have been reviewed.

• Where feasible, use a prebuilt and verified environment containing the required browser and operating-system dependencies.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The documentation recommends npx playwright install-deps chromium, which invokes an unpinned package resolution path and may fetch whatever Playwright version is current at execution time. In a high-privilege browser automation context, this weakens supply-chain integrity and reproducibility, and could expose users to malicious or compromised upstream package versions if the registry or dependency chain is attacked.

Content

No source excerpt is available for this finding.