Agent Browser

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:05 PM UTC
• Version: 0.1.0

Overview

This browser automation skill is useful and mostly purpose-aligned, but it grants broad web, session, credential, capture, and mutable executable authority with several under-scoped safety controls.

Install only if you need a powerful browser automation agent and are prepared to manage it like a credential-handling tool. Pin and review the executable version, prefer isolated test accounts and profiles, enable domain allowlists and action policies, avoid importing your normal browser session when possible, encrypt or delete saved auth state, do not publish screenshots/recordings/traces from authenticated pages, and avoid the proxy guidance for bypassing rate limits or bans.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Third-Party Executable Dependencies

Content

View full analysis

Remediation

View remediation

cargo install agent-browser --version --locked npm install -g appium@ appium driver install xcuitest@ ``` 2. Use project-local dependencies and lockfiles instead of global installations where supported. 3. Verify downloaded browser binaries and drivers using publisher signatures or documented SHA-256 checksums. 4. Configure trusted registries explicitly and enable package-manager integrity and provenance checks. 5. Review lifecycle scripts before installation and disable them when they are unnecessary. 6. Run installation without administrative privileges and isolate dependency setup in a container or restricted build environment. 7. Separate upgrades from normal Skill execution and require explicit review before adopting a new release. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:55

Finding

Authentication State Is Stored in Plaintext by Default

Content

View full analysis

[state-file]}" STATE_FILE="${2:-./auth-state.json}" echo "Authentication workflow: $LOGIN_URL" if [[ -f "$STATE_FILE" ]]; then echo "Loading saved state from $STATE_FILE..." if agent-browser --state "$STATE_FILE" open "$LOGIN_URL" 2>/dev/null; then agent-browser wait --load networkidle CURRENT_URL=$(agent-browser get url) if [[ "$CURRENT_URL" != *"login"* ]] && [[ "$CURRENT_URL" != *"signin"* ]]; then echo "Session restored successfully" agent-browser snapshot -i exit 0 fi echo "Session expired, performing fresh login..." agent-browser close 2>/dev/null || true else echo "Failed to load state, re-authenticating..." fi rm -f "$STATE_FILE" fi ``` ```bash # templates/authenticated-session.sh:101-103 # Save state for future runs # echo "Saving state to $STATE_FILE" # agent-browser state save "$STATE_FILE" ``` ### Technical Analysis The documented workflows save cookies, local storage, and authentication tokens to files such as `./auth.json` and `./auth-state.json`. The Skill explicitly acknowledges that these files contain session t ...[truncated 2038 chars]

Remediation

View remediation

/dev/null || true rm -f -- "$STATE_FILE" } trap cleanup EXIT ``` 8. Use short-lived, least-privileged test accounts in CI and disable persistence entirely when session reuse is unnecessary. 9. Document token revocation procedures for cases where a state file may have been exposed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (22)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

Session recording and profiling can capture sensitive page content, credentials entered during login flows, tokens displayed in the UI, or user data present during browser automation. In this skill, the risk is elevated because the same documentation encourages authenticated sessions and unrestricted browsing, making recordings a plausible source of context leakage or sensitive artifact retention.

Content

Scanner excerpt · SKILL.md (reported line 380)May include surrounding context.

agent-browser --headed open https://example.com agent-browser highlight @e1 # Highlight element agent-browser inspect # Open Chrome DevTools for the active page agent-browser record start demo.webm # Record session agent-browser profiler start # Start Chrome DevTools profiling agent-browser profiler stop trace.json # Stop and save profile (path optional)

text

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 93% confidence

Finding

The documentation explicitly instructs users to launch Chrome with a remote debugging port and then export cookies/localStorage from an already authenticated browser session. Although framed as a convenience feature and accompanied by warnings, this pattern materially enables session hijacking and plaintext extraction of live authentication artifacts, which is especially dangerous in an agent-browser skill whose purpose is automated web interaction.

Content

Scanner excerpt · references/authentication.md (reported line 24)May include surrounding context.

ication](#restoring-authentication)

• OAuth / SSO Flows
• Two-Factor Authentication
• HTTP Basic Auth
• Cookie-Based Auth
• Token Refresh Handling
• Security Best Practices

Import Auth from Your Browser

The fastest way to authenticate is to reuse cookies from a Chrome session you are already logged into.

Step 1: Start Chrome with remote debugging

bash

# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --remote-debugging-port=9222

# Linux
google-chrome --remote-debugging-port=9222

# Windows
"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222

Log in to your target site(s) in this Chrome window as you normally would.

Security note: --remote-debugging-port exposes full browser control on localhost. Any local process can connect and read cookies, execute JS, etc.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/authentication.md (reported line 294)May include surrounding context.

3. Clean up after automation

   bash

   agent-browser cookies clear
   rm -f ./auth-state.json
   

4. Use short-lived sessions for CI/CD

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Documenting state save auth.json without warning is dangerous because the saved file may contain reusable cookies, storage tokens, and authentication state that can directly re-authenticate another browser session. This effectively creates a portable credential bundle, and the absence of warnings makes accidental insecure storage or sharing more likely.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/session-management.md (reported line 185)May include surrounding context.

echo "*.auth-state.json" >> .gitignore

Delete after use

rm /tmp/auth-state.json

text

### 4. Timeout Long Sessions

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill manifest references npx agent-browser without version pinning, so skill execution may fetch whatever package version is current when invoked. Because this tool has broad browser and filesystem-adjacent capabilities, a malicious upstream update could immediately gain powerful execution in agent workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation text is extremely broad and is likely to trigger on many normal browsing requests, causing this high-capability skill to be selected more often than necessary. Over-broad routing increases the chance an agent will invoke browser automation, login handling, downloads, or other risky functions in contexts where a safer tool or no tool should be used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation prominently enables login flows, downloads, local file access, persistent sessions, clipboard access, and unrestricted automation, while only later noting that security controls are opt-in and defaults are unrestricted. In an agent context, that omission materially increases the risk of privacy exposure, unintended state reuse, data exfiltration, or harmful actions on third-party sites without clear operator awareness.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The manifest allows execution via npx agent-browser without a pinned version, which means the resolved package can change over time and may pull a compromised or typosquatted release at runtime. In an agent skill that automates browsers and can handle authentication state, downloads, clipboard access, and unrestricted web actions, this creates a meaningful supply-chain execution risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The configuration example encourages persistent local profiles ("profile": "./browser-data"), which can retain cookies, localStorage, and authenticated session material across runs. In an agent environment, persistent state can be unintentionally reused by later tasks or agents, exposing accounts or cross-task data and making cleanup harder.

Content

Scanner excerpt · SKILL.md (reported line 628)May include surrounding context.

Configuration File

Create agent-browser.json in the project root for persistent settings:

json

{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation encourages saving screenshots, PDFs, videos, traces, and profiles without warning that these artifacts can capture sensitive page contents, tokens, PII, or internal application state. In an agent-driven browser automation skill, users may record authenticated sessions or private data and then persist those artifacts to disk where they can be reused, exfiltrated, or mishandled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The commands expose cookies, localStorage, and HTTP basic credentials with no security guidance, even though these values often function as live authentication secrets. Because this skill is specifically for browser automation, an agent can easily access and export session material from real user sessions, making undocumented handling of these secrets especially dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The eval commands allow arbitrary JavaScript execution in the page context, but the examples provide no warning that this can read page data, manipulate forms, access DOM-exposed secrets, or alter application behavior. In an agent setting, this materially increases the risk of unsafe automation or data extraction from sensitive pages under the guise of routine browser actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

Restoring previously saved browser state enables session persistence and replay, which is a legitimate feature but also allows reuse of captured authentication material. In this browser automation context, that increases the chance that stolen or accidentally shared state files can be used to impersonate a user across sites or internal apps.

Content

Scanner excerpt · references/commands.md (reported line 242)May include surrounding context.

bash

agent-browser state save auth.json    # Save cookies, storage, auth state
agent-browser state load auth.json    # Restore saved state

Global Options

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document explicitly frames proxy support as useful for 'rate limiting avoidance,' which normalizes evasion behavior unrelated to ordinary browser automation. In an agent-facing skill, this can steer users or downstream agents toward abusive scraping or anti-detection workflows that violate site controls and policies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The authenticated proxy examples place usernames and passwords directly in environment variables and command strings without warning about credential exposure through shell history, process inspection, logs, CI output, or shared session state. In an AI-agent/browser-automation setting, these examples may be copied into automated workflows, increasing the chance of accidental secret leakage.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The rotating-proxies example instructs users to cycle proxies 'to avoid rate limiting' and recommends distributing load to avoid bans, which is operational guidance for evading website defenses. Given this skill is for browser automation, providing turnkey anti-rate-limit scraping patterns increases misuse potential and can enable abusive collection at scale.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 55% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/session-management.md (reported line 55)May include surrounding context.

Load Session State

bash

# Restore saved state
agent-browser state load /path/to/auth-state.json

# Continue with authenticated session

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation encourages recording browser sessions, screenshots, login flows, and CI artifacts without warning that captured media may include passwords, session tokens, personal data, internal URLs, or other sensitive content. In an agent-browser skill, this is more dangerous than in generic video tooling because the skill is explicitly used to automate logins, forms, and web-app interactions, making secret and PII capture a likely outcome.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This template explicitly instructs users to place credentials in APP_USERNAME and APP_PASSWORD and to save authenticated browser state to a file, but it does not prominently warn that environment variables may be exposed through shell history, process inspection, CI logs, or inherited subprocess environments, and that session-state files can grant account access if copied. In a browser-automation skill, this is more dangerous because the workflow is specifically designed to authenticate to real services and persist reusable sessions, increasing the chance of credential or session-token leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This workflow automatically captures full-page screenshots, full body text, and a PDF of whatever page is visited, then saves them locally without any warning, confirmation, or minimization. If used on pages containing personal data, internal documents, account data, or regulated content, it can create unintended local copies that persist beyond the browsing session and increase data leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The template includes support for loading an authentication state file for protected pages, which can cause the script to access and export content from authenticated sessions without any warning about the sensitivity of session-backed data. In the context of a browser automation skill, this is more dangerous because the tool is specifically intended to interact with live websites, including logged-in areas, making accidental capture of private account or enterprise data more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.