Agent Browser Backup 20260407

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:14 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is purpose-aligned, but it under-explains the risks of saving authenticated browser sessions and installing an unpinned global CLI.

Install only if you are comfortable with a browser automation tool that can interact with arbitrary websites and save page/session artifacts. Prefer a pinned CLI version, avoid root/admin installs, use test accounts where possible, treat saved state files like passwords, store them outside projects with restrictive permissions, and delete them when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned Third-Party CLI Installation Enables Supply-Chain Compromise## Vulnerability Details **File Location**: `SKILL.md:17-33`; related instruction at `CONTRIBUTING.md:19-22` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:17-33`: ```bash ### npm recommended ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` ### From Source ```bash git clone https://github.com/vercel-labs/agent-browser cd agent-browser pnpm install pnpm build agent-browser install ``` ``` `CONTRIBUTING.md:19-22`: ```bash 1. Install the latest version ```bash npm install -g agent-browser@latest ``` ``` ### Technical Analysis The installation instructions execute mutable third-party content without pinning an npm package version, Git commit, dependency lockfile state, or integrity hash. The `@latest` instruction explicitly selects whichever release is current at installation time. Likewise, cloning the repository without checking out a reviewed commit causes the build to consume the current default branch. Global npm installation can execute package lifecycle scripts with the installing user's privileges. The source-build path also executes dependency lifecycle scripts through `pnpm install` and subsequently runs upstream build and installation logic. Although the named npm package and GitHub repository are consistent with the documented upstream project and there is no evidence of typosquatting in the audited files, these mutable installation paths prevent reproducible verification. ### Attack Path 1. An attacker compromises the upstream npm publishing account, repository, dependency chain, or release process. 2. The attacker publishes a malicious version under the legitimate package name or adds malicious installation/build logic to the repository's default branch. 3. A user follows the documented `npm install -g agent-browser`, `npm install -g agent- ...[truncated 954 chars]
• Remediation: ## Remediation Suggestions 1. Pin `agent-browser` to a reviewed, exact version instead of using an implicit current release or `@latest`. 2. Pin source installation to a full Git commit hash and verify that commit against a trusted signed release or tag. 3. Retain and enforce a reviewed lockfile for source builds, using immutable/frozen-lockfile installation options. 4. Verify package integrity through registry integrity metadata, checksums, signed provenance, or Sigstore attestations where available. 5. Remove `npm install -g agent-browser@latest` from troubleshooting guidance. 6. Prefer a project-local or isolated installation over a global installation to reduce the modification scope. 7. Document that users should not run package installation with administrator or root privileges. 8. Review lifecycle scripts and transitive dependency changes before upgrading the pinned version.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:231
• Finding: Authentication Session State Is Saved to an Unprotected Plaintext File## Vulnerability Details **File Location**: `SKILL.md:231-232` and `SKILL.md:250-258`; equivalent example at `演示文档.md:156-163` **Vulnerability Type**: Insecure storage of sensitive browser session data **Risk Level**: Medium ### Vulnerable Code `SKILL.md:231-232`: ```bash agent-browser state save auth.json # Save session state agent-browser state load auth.json # Load saved state ``` `SKILL.md:250-258`: ```bash # Login once agent-browser open https://app.example.com/login agent-browser snapshot -i agent-browser fill @e1 "username" agent-browser fill @e2 "password" agent-browser click @e3 agent-browser wait --url "/dashboard" agent-browser state save auth.json ``` `演示文档.md:156-163`: ```bash # 第一次：登录并保存状态 agent-browser open https://app.example.com/login agent-browser snapshot -i agent-browser fill @e1 "username" agent-browser fill @e2 "password" agent-browser click @e3 agent-browser wait --url "/dashboard" agent-browser state save auth.json ``` ### Technical Analysis The documentation instructs users to save authenticated browser state to a predictably named `auth.json` file in the current working directory. Browser state commonly includes cookies and local-storage values, which may contain bearer session tokens, refresh tokens, or other authentication artifacts. No guidance is provided to enforce owner-only permissions, select a protected storage directory, encrypt the file, exclude it from source control and backups, or securely delete it after use. Consequently, the confidentiality of the saved state depends on ambient filesystem permissions and user behavior rather than an explicit security control. ### Attack Path 1. A user authenticates to a web application through `agent-browser`. 2. The browser receives session cookies or storage-based authentication tokens. 3. The user runs `agent-browser state save auth.json` as documented. 4. The session material is written t ...[truncated 1010 chars]
• Remediation: ## Remediation Suggestions 1. Store browser state outside the project and current working directories in a dedicated private directory. 2. Create the destination with owner-only permissions and set a restrictive umask before saving, for example: ```bash umask 077 mkdir -p "$HOME/.local/state/agent-browser" agent-browser state save "$HOME/.local/state/agent-browser/auth.json" ``` 3. Prefer operating-system credential storage or an encrypted secret store when supported. 4. Add `auth.json`, browser-state files, and the dedicated state directory pattern to `.gitignore`. 5. Warn users not to include state files in logs, issue reports, build artifacts, shared folders, or cloud-synchronized directories. 6. Delete saved state securely when it is no longer required and revoke the corresponding server-side session. 7. Use short-lived, least-privileged test accounts for automation rather than privileged personal or production accounts. 8. Add explicit documentation that saved browser state must be treated as a credential.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The login example shows entering credentials and saving authenticated browser state to auth.json without any guidance on secret handling, storage protection, or session reuse risks. This is dangerous because leaked credentials or session state can enable account takeover, persistence of unauthorized access, or lateral misuse by other agents or users on the system.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly documents HTTP basic auth, cookies, localStorage, and session state save/load features without any warning that these artifacts may contain secrets, bearer tokens, or authenticated session material. In an agent context, this increases the chance that credentials are persisted, echoed in logs, or reused across tasks, enabling account compromise or unintended cross-session data exposure.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 92% confidence
• Finding: The skill documents saving and loading browser session state from a file, which commonly includes cookies and authenticated session tokens. Without warnings or safeguards, agents may persist reusable authentication material to disk, creating a straightforward path to session hijacking if the file is exposed.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 94% confidence
• Finding: The authentication example normalizes a workflow where login state is saved to auth.json and later reloaded, but it does not mention that this file can grant access equivalent to a live session. In an agent environment, this materially raises the risk of credential/session reuse beyond the intended task boundary.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation provides a realistic form-filling and submission workflow using personal data fields such as name, email, phone, and city, but gives no warning against using real user data or submitting to production systems. In an agent-execution context, this can lead to unintended transmission, modification, or creation of records containing sensitive personal information.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The screenshot, recording, and PDF examples encourage capturing page contents to files but do not warn that these artifacts may contain sensitive on-screen data, tokens, personal information, or proprietary content. In agent workflows, such files can be retained, shared, or indexed unintentionally, expanding the exposure beyond the live browser session.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The documented screenshot, PDF, and recording commands write artifacts to disk and may capture sensitive page content, tokens, PII, or internal application state, but the skill gives no warning about this. In an automation skill used by agents, such artifacts can be unintentionally retained, shared, or ingested by other tooling.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The demo directs the tool to open external websites and interact with them, but it does not disclose that these commands initiate outbound network requests and may expose browsing behavior, IP address, cookies, or agent context to third-party sites. For a browser automation skill, undisclosed external access is a real transparency and privacy issue, even though the example uses common public sites.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The demo instructs users to save screenshots to local files such as /tmp/example.png and /tmp/baidu.png without any disclosure that page contents may contain sensitive information. In an agent/browser automation context, screenshots can capture credentials, personal data, or internal pages, so silent file writes create a privacy and data-handling risk even if the example itself is non-malicious.

Static analysis

No suspicious patterns detected.