Agent Browser Cn

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:48 PM UTC
• Version: 1.0.0

Overview

This browser automation skill is mostly coherent, but it exposes authenticated browser state, cookies, recordings, traces, and an unpinned global install path without enough safety guidance.

Review carefully before installing. Use it only in a contained environment, avoid running it against sensitive accounts unless necessary, treat saved state files, screenshots, videos, PDFs, traces, cookies, and localStorage as secrets, delete them after use, and prefer a pinned, reviewed local install over the documented global latest install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20
• Finding: Unpinned Global npm Installation Creates a Supply-Chain Execution Risk## Vulnerability Details **File Locations**: `SKILL.md:20-22`; `CONTRIBUTING.md:23-25` **Vulnerability Type**: Unpinned and mutable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:20-22`: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` `CONTRIBUTING.md:23-25`: ```bash npm install -g agent-browser@latest ``` ### Technical Analysis The installation instructions retrieve and globally install `agent-browser` without pinning an exact reviewed version. The troubleshooting instructions explicitly select `@latest`, making the installed artifact dependent on the package registry state at execution time. npm installation can execute package lifecycle scripts with the privileges of the invoking user. A global installation also places executable files into shared user-level or system-level npm locations. Furthermore, `agent-browser install --with-deps` may retrieve and install additional mutable components without documented versions, checksums, or integrity-validation procedures. The audited project does not itself contain a malicious payload, and the evidence does not establish that the current upstream package is malicious. The vulnerability is the absence of controls that ensure users receive the same reviewed dependency release over time. ### Attack Path 1. An attacker compromises the upstream npm package, a maintainer account, or another component in the dependency publication chain. 2. The attacker publishes a malicious release under the expected package name. 3. A user or AI agent follows the documented `npm install -g agent-browser`, `npm install -g agent-browser@latest`, or dependency-installation instructions. 4. npm resolves the mutable package reference to the attacker-controlled release. 5. Malicious lifecycle code executes during installation, or a compromised globally installed executable runs when subsequent d ...[truncated 999 chars]
• Remediation: ## Remediation Suggestions 1. Replace mutable package references with an exact version that has been reviewed: ```bash npm install --save-exact agent-browser@<reviewed-version> ``` 2. Remove the recommendation to install `@latest`. Document a controlled upgrade and security-review process instead. 3. Prefer a project-local dependency over a global installation, and commit a lockfile so transitive versions are reproducible. 4. Verify downloaded artifacts using registry integrity metadata, checksums, or signed provenance before execution. 5. Document the exact components and versions installed by `agent-browser install` and `agent-browser install --with-deps`. 6. Run installation without administrative privileges and in an isolated environment where practical. 7. Consider disabling npm lifecycle scripts during initial acquisition and reviewing the package before enabling any required installation scripts. 8. Periodically audit the pinned package and its transitive dependencies, then update pins only after review.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents screenshots, PDFs, video recording, console logs, and traces without noting that these artifacts may capture credentials, personal data, tokens, page content, or debugging secrets. In browser automation workflows, such artifacts are commonly persisted or shared, so omitting handling guidance increases the risk of sensitive data leakage.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly encourages saving and loading browser session state but does not warn that the state file can contain authentication cookies, bearer tokens, and other sensitive session artifacts. In an agent environment, this can lead to credential theft, unintended privilege reuse across tasks, or accidental disclosure if the file is stored insecurely or reused in the wrong context.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 94% confidence
• Finding: Loading saved browser state enables session persistence across runs, which can silently transfer authenticated context between tasks, users, or trust boundaries. Without warnings or safeguards, this increases the chance of unauthorized account access, stale privileged sessions, or replay of sensitive authenticated state.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 94% confidence
• Finding: The authentication example normalizes reusing saved state for later sessions without highlighting that the file may preserve active login context. In agent-driven environments, this makes accidental privilege carryover and credential-equivalent file exposure more likely, especially if artifacts are reused broadly.

Static analysis

No suspicious patterns detected.