ClawHub
Back to skill

Security audit

Agent Browser Tianjin

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent browser-automation wrapper, but users should treat saved sessions, screenshots, recordings, cookies, and install commands with normal credential and supply-chain caution.

Install only from a trusted upstream agent-browser release, preferably pinned to a reviewed version or commit. Avoid using this skill on sensitive authenticated sites unless needed, and treat screenshots, recordings, traces, cookies, localStorage exports, and saved state files like secrets; keep them out of repositories and delete them when no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned Third-Party Package and Source Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:20-22, SKILL.md:28-32, and CONTRIBUTING.md:23-26
Vulnerability Type: Mutable and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

SKILL.md:20-22:

bash
npm install -g agent-browser
agent-browser install
agent-browser install --with-deps

SKILL.md:28-32:

bash
git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
pnpm install
pnpm build
agent-browser install

CONTRIBUTING.md:23-26:

bash
1. Install the latest version
   ```bash
   npm install -g agent-browser@latest
   ```

Technical Analysis

The documented installation procedures retrieve and execute mutable third-party content without pinning it to an audited package version, immutable commit, or verified integrity digest.

npm install -g agent-browser resolves to the package version selected by the registry at installation time, while the explicit agent-browser@latest instruction follows a mutable npm distribution tag. npm installation can execute package lifecycle scripts under the privileges of the invoking user. The subsequent agent-browser install and agent-browser install --with-deps commands also execute code supplied by the newly installed package and may install additional browser or operating-system components.

The source installation procedure clones the repository's current default branch rather than an audited commit or signed release. It then resolves dependencies and builds that mutable source. Consequently, the code executed by users may differ from the code that was reviewed when this Skill was published.

No evidence shows that the current upstream package or repository is malicious. The vulnerability is the absence of controls that prevent a compromised publisher account, dependency, registry release, or upstream branch from changing the code users install.

Attack

...[truncated 1806 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace mutable npm installation commands with an exact, reviewed version:

    bash
    npm install -g agent-browser@<audited-version>

  2. Record and verify the expected npm package integrity digest or provenance before installation. Document the trusted package scope and publisher identity.

  3. Pin source installations to an immutable, reviewed commit or signed release:

    bash
    git clone https://github.com/vercel-labs/agent-browser
cd agent-browser
git checkout <audited-commit-sha>

  4. Verify release signatures or commit signatures where supported, and compare the checked-out commit against a documented expected hash.

  5. Use the upstream lockfile with a frozen or immutable installation mode, such as:

    bash
    pnpm install --frozen-lockfile

  6. Review package lifecycle scripts and the implementation of agent-browser install before execution. Consider disabling lifecycle scripts during dependency resolution when they are unnecessary.

  7. Avoid privileged installation. Prefer an isolated, non-administrative environment, project-local dependency, container, or dedicated service account with minimal filesystem and credential access.

  8. Remove the recommendation to use @latest. Establish an explicit dependency-update process in which each new version and associated lockfile change is reviewed before the documented pin is updated.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly documents screenshots, video recording, request inspection, cookies, and localStorage access, but provides no warning that these features can capture authentication tokens, personal data, or other secrets. In an agent context, this omission increases the chance that operators will use the tool on sensitive pages without understanding the privacy and credential exposure risks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
92% confidence
Finding

The skill documents saving and loading browser state to a file, which can persist cookies, tokens, and other authenticated session material. Without warnings about secure storage, file permissions, rotation, and cleanup, users may unintentionally create reusable credential artifacts that can be stolen or reused by other processes or users.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The authentication example normalizes reusing saved login state across sessions, which can propagate authenticated access through portable files. In the context of an automation skill, this makes accidental credential persistence and lateral reuse more likely if the state file is copied, logged, or shared.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Static analysis

No suspicious patterns detected.