Vanzhangsh Skills

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:32 AM UTC
• Version: 1.0.0

Overview

This is a legitimate browser automation helper, but it directs users to install and use a powerful external CLI without enough safeguards for credentials, saved sessions, and captured page data.

Review this before installing. Use a pinned, trusted version of agent-browser if possible, avoid running install commands with elevated privileges, and treat saved browser state, screenshots, videos, traces, network logs, cookies, headers, and credentials as sensitive secrets. Do not commit auth.json or captured browser artifacts to shared repositories.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Unpinned Third-Party Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14-16`, `SKILL.md:22-25`, and `CONTRIBUTING.md:24` **Vulnerability Type**: Mutable and unverified third-party dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:14-16`: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` `SKILL.md:22-25`: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build agent-browser install ``` `CONTRIBUTING.md:24`: ```bash npm install -g agent-browser@latest ``` ### Technical Analysis The documented installation procedures do not pin the npm package to an audited version, pin the Git repository to a specific commit, or verify downloaded artifacts using an integrity digest or trusted signature. The global npm installation and explicit use of `@latest` resolve package content at installation time. Consequently, the package that users execute can differ from the package available when this Skill was audited. npm package installation may also execute package lifecycle scripts under the installing user's account. The source installation procedure clones the moving default branch and invokes `pnpm install` without demonstrating a committed, verified lockfile or an integrity-verification process. It then builds and executes the resulting CLI. This creates supply-chain exposure to changes in the upstream repository and its transitive dependencies. No evidence indicates that the current upstream package is malicious. The vulnerability is the trust placed in mutable and insufficiently verified third-party content. ### Attack Path 1. An attacker compromises the upstream npm publisher account, source repository, release process, package registry, or a transitive dependency. 2. The attacker publishes a malicious package version, modifies the moving default branch, or introduces a malicious dependency or lifecycle script. 3. A user follows the documented `npm install ...[truncated 1271 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the npm dependency to a specific audited version rather than installing an unqualified package or `@latest`: ```bash npm install -g agent-browser@<audited-version> ``` 2. Publish and verify the expected npm integrity digest or a cryptographically signed release before installation. 3. Pin source installations to a reviewed full commit hash: ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser git checkout --detach <reviewed-full-commit-hash> ``` 4. Require a committed lockfile and use a frozen-lockfile installation mode so dependency resolution cannot silently change: ```bash pnpm install --frozen-lockfile ``` 5. Avoid global installation where practical. Prefer a project-local, containerized, or otherwise sandboxed installation with minimal filesystem and network permissions. 6. Do not instruct users to install `@latest` as a troubleshooting step. Document a tested compatibility matrix and update the pinned version only after security review. 7. Document the exact system changes and privilege requirements of `agent-browser install --with-deps`. Explicitly discourage execution as root or through `sudo` unless strictly required and independently reviewed. 8. Add automated dependency provenance, vulnerability, and lockfile-integrity checks to the release process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill promotes screenshots, PDFs, video recording, tracing, and network request inspection without cautioning that these artifacts can capture page contents, tokens, PII, headers, and other sensitive data. In an authenticated browser automation context, those outputs can become durable copies of confidential information and are easy to leak via logs, shared folders, or bug reports.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation shows direct credential usage via command-line arguments for HTTP basic auth and elsewhere demonstrates filling login forms, but it does not warn that secrets passed on the command line can be exposed through shell history, process listings, logs, or recordings. This creates a realistic risk of credential leakage during normal use of the skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs users to save and reload authenticated browser state, which commonly includes cookies and other session artifacts, but it provides no warning that the saved file is sensitive. If that file is stored insecurely, shared, or committed to source control, an attacker may be able to reuse the session and access authenticated resources without credentials.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 95% confidence
• Finding: The documented ability to save and later load browser session state enables persistence of authenticated sessions across runs. Without warnings or safeguards, this increases the chance that session-bearing files are mishandled, stolen, or reused to impersonate a user.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 95% confidence
• Finding: The example normalizes reusing a previously saved authenticated state file to access a dashboard in later sessions, but it omits any caution about the security implications of session replay. In this skill's context, that file can function like a bearer token for the target application.

Static analysis

No suspicious patterns detected.