Demo Resource Upload Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:07 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward browser automation guide, with expected but sensitive auth-state and install risks that users should handle carefully.

Install from a trusted source, prefer a pinned or reviewed version where possible, and keep saved auth state files private because they can behave like login credentials. Use cookie, storage, and network-mocking commands only for sites and sessions you intend the agent to control.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:197

Finding

Unpinned Global Package and Runtime Component Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 197–199
Vulnerability Type: Supply-chain exposure through mutable third-party dependencies
Risk Level: Medium

Vulnerable Code:

bash

npm install -g agent-browser
agent-browser install                     # Download Chromium
agent-browser install --with-deps         # Linux: + system deps

Technical Analysis

The installation instructions globally install agent-browser without pinning an audited version or verifying package integrity. The subsequent installation commands download Chromium and, when --with-deps is used, may also install operating-system dependencies.

Because neither an exact version nor artifact checksums or signatures are specified, the content executed by users can change after the skill has been reviewed. A compromised npm package, transitive dependency, package registry account, browser artifact, or component download source could therefore introduce attacker-controlled code. Global installation and optional system dependency installation expand the affected scope compared with a pinned, project-local dependency.

Attack Path

1. An attacker compromises the npm package, one of its transitive dependencies, its publisher account, or a runtime component download source.
2. The attacker publishes or substitutes a malicious package or component while retaining the expected package name.
3. A user follows the documented command npm install -g agent-browser without an exact version or integrity constraint.
4. npm retrieves the mutable release and executes any applicable installation lifecycle code with the invoking user's privileges.
5. The user runs agent-browser install or agent-browser install --with-deps, causing additional unverified browser or system components to be downloaded and installed.
6. Malicious installer code can access resources available to the invoking account and potentially affect globally in ...[truncated 663 chars]

Remediation

View remediation

Remediation Suggestions

• Pin agent-browser to a specifically reviewed version rather than installing the latest mutable release.
• Prefer a project-local dependency and invoke it through the project's package manager instead of using a global installation.
• Commit and enforce a lockfile with integrity metadata for the package and its transitive dependencies.
• Verify downloaded Chromium and other runtime artifacts using trusted checksums or cryptographic signatures.
• Document the exact package publisher, registry, release, and browser artifact sources expected during installation.
• Disable or carefully review package lifecycle scripts where operationally possible.
• Avoid --with-deps unless operating-system changes are necessary and have been explicitly reviewed.
• Perform installation in a sandbox, container, or restricted environment using a non-privileged account.
• Establish dependency-update review and provenance verification before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly recommends saving and loading browser auth state files to skip login flows, but does not warn that these files can contain live session cookies, tokens, and other sensitive browser state. In an agent setting, this increases the chance that users persist reusable authentication material insecurely, share it accidentally, or load untrusted state files that compromise an account session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents commands to read and modify cookies and browser storage without any privacy or integrity warning. In practice, these commands can expose session identifiers and personal data or alter authentication and application state, which is especially risky in a browser automation skill intended for AI agents that may operate across multiple accounts and contexts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.