Security audit

agent-browser

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed browser-automation helper, but users should treat saved browser state and global installation steps carefully.

Install only from a trusted npm source, prefer a pinned local dependency over a global latest install, and avoid running the system dependency installer with elevated privileges unless necessary. Treat saved auth files, cookies, and storage values like credentials: create them only for accounts you authorize, keep them private, avoid logging them, and delete them when no longer needed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:197
Finding: Unpinned Global Package and Browser Component Installation
Content: View full analysis
Remediation: View remediation
``` 2. Prefer a project-local dependency over global installation, and commit a lockfile generated with a trusted npm client. 3. Use `npm ci` with a reviewed lockfile in automated or reproducible environments. 4. Record and verify package provenance and integrity, including the expected npm package digest and publisher identity. 5. Pin Chromium and other downloaded components to reviewed versions and verify cryptographic checksums or signatures before execution. 6. Avoid `--with-deps` by default. If system dependencies are required, list them explicitly and install them through the operating system's trusted package manager. 7. Run installation without administrative privileges whenever possible and isolate browser automation in a restricted container or dedicated low-privilege account. 8. Review npm lifecycle scripts and the transitive dependency tree before approving version updates. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly exposes commands for reading cookies, local storage, and saving/loading browser auth state, which can contain session tokens and other sensitive credentials. In an agent-facing skill, documenting these capabilities without any warning, consent boundary, or handling guidance increases the chance that an agent will exfiltrate, persist, or replay privileged session material during normal automation flows.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.