Security audit

AgentBrowse

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent browser-automation helper, but users should handle screenshots, extracted page data, installs, and API keys carefully.

Install only if you trust the AgentBrowse CLI publisher and are comfortable giving it access to the browser pages you automate. Avoid using screenshot or extract on sensitive pages unless needed, keep API keys out of shared terminals and logs, and prefer a reviewed pinned CLI version where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:32
Finding: Unpinned Global npm Package Installation Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/commands.md:48
Finding: API Key Passed Through Command-Line Arguments
Content: View full analysis
[--api-url ]` Store the API key used by AI-assisted `observe` (with a natural-language goal) and any `extract` in the local config file. Core browser commands do not need this setup. ``` Related instructions in `SKILL.md:39-42`: ```markdown - AI-assisted features — `observe` with a natural-language goal and `extract` — call an LLM through the gateway. Configure API access with `agentbrowse init ` before using them. Pass a non-default API URL during init if needed. ``` Related instructions in `references/workflow.md:19-21`: ```markdown - `observe` with a natural-language goal, and any `extract`, call an LLM through the gateway. Configure API access with `agentbrowse init ` before using them. ``` ### Technical Analysis The documented interface requires the API key to be provided as a command-line argument. Command-line secrets can be exposed through several local channels: - Shell history files. - Process-listing and process-inspection interfaces while the command runs. - Terminal session recording. - CI/CD command logs and agent execution telemetry. - Error reports or debugging output that captures the invoked command. The documentation also states that the API key is stored in a local configuration file but does not specify its location, permissions, encryption, or redaction behavior. This creates an additional uncertainty around credential-at-rest protection, although the available project files do not establish that the configuration is definitely stored insecurely. ### Attack Path 1. A user obtains a valid gateway API key and fo ...[truncated 1489 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill explicitly enables screenshots and structured page extraction on arbitrary websites, but it does not clearly warn that these actions may capture sensitive on-page data such as personal information, session details, account balances, or other confidential content. In a browser automation context, that omission can lead an agent to collect or persist sensitive data without informed user awareness, especially when combined with broad instructions to inspect, extract, and debug page state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation instructs users to store an API key in a local config file but does not warn that this is sensitive credential material, where it is stored, what file permissions are used, or whether the value is encrypted. In a browser automation skill, this is meaningful because local config files are commonly copied into backups, logs, dotfile sync tools, or shared workspaces, which can expose the key and enable unauthorized use of the AI-assisted features or associated account resources.
Content: No source excerpt is available for this finding.