AgentBrowse

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:18 AM UTC
• Version: 0.1.22

Overview

This skill is a coherent browser-automation helper, but users should handle screenshots, extracted page data, installs, and API keys carefully.

Install only if you trust the AgentBrowse CLI publisher and are comfortable giving it access to the browser pages you automate. Avoid using screenshot or extract on sensitive pages unless needed, keep API keys out of shared terminals and logs, and prefer a reviewed pinned CLI version where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32
• Finding: Unpinned Global npm Package Installation Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-34` **Additional Location**: `references/commands.md:63-65` **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Complete Code Snippet From `SKILL.md:32-34`: ```markdown - `agentbrowse` must be available on `PATH`. If it is missing or outdated, run `npm i -g @mercuryo-ai/agentbrowse-cli@latest`, then verify with `agentbrowse --version`. ``` The instruction is repeated in `references/commands.md:63-65`: ```markdown If the command is missing or outdated, run `npm i -g @mercuryo-ai/agentbrowse-cli@latest`, then rerun `agentbrowse --version`. ``` ### Technical Analysis The installation command resolves the mutable npm tag `latest` rather than a reviewed, exact package version. Consequently, the artifact installed when the skill is used may differ from the artifact that existed when the skill was audited. The `-g` option installs the package globally and exposes its executable through the system-wide command lookup path. Depending on the local npm configuration, package lifecycle scripts may also execute during installation. An upstream package compromise, publisher-account takeover, or malicious future release could therefore introduce arbitrary code without requiring any modification to this repository. The package name is consistent across the project and there is no evidence that it is intentionally typosquatted. The risk arises from mutable version resolution, absence of integrity verification, and global installation rather than from confirmed malicious behavior in the named package. ### Attack Path 1. An attacker compromises the npm publisher account, release pipeline, or package distribution channel for `@mercuryo-ai/agentbrowse-cli`. 2. The attacker publishes a malicious release and assigns it to the `latest` distribution tag. 3. A user or agent follows the documented command: `npm i -g @mercuryo-ai/agentbrowse-cli@latest ...[truncated 1091 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed version, for example: ```bash npm install --global @mercuryo-ai/agentbrowse-cli@X.Y.Z ``` 2. Update the pinned version only after reviewing its source, release provenance, and dependency changes. 3. Prefer a project-local installation governed by a committed lockfile rather than a global installation. 4. Use npm integrity and provenance controls where supported, and install only from an explicitly trusted registry. 5. Consider disabling package lifecycle scripts during installation when they are not required: ```bash npm install --ignore-scripts --save-exact @mercuryo-ai/agentbrowse-cli@X.Y.Z ``` 6. Document a minimum supported version separately rather than instructing agents to install whatever release currently owns the `latest` tag. 7. Apply the same hardened installation instruction consistently in both `SKILL.md` and `references/commands.md`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/commands.md:48
• Finding: API Key Passed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `references/commands.md:48-52` **Additional Locations**: `SKILL.md:39-42`, `references/workflow.md:19-21` **Vulnerability Type**: Sensitive credential exposure through process arguments and command history **Risk Level**: Medium ### Complete Code Snippet From `references/commands.md:48-52`: ```markdown ### `agentbrowse init <apiKey> [--api-url <url>]` Store the API key used by AI-assisted `observe` (with a natural-language goal) and any `extract` in the local config file. Core browser commands do not need this setup. ``` Related instructions in `SKILL.md:39-42`: ```markdown - AI-assisted features — `observe` with a natural-language goal and `extract` — call an LLM through the gateway. Configure API access with `agentbrowse init <apiKey>` before using them. Pass a non-default API URL during init if needed. ``` Related instructions in `references/workflow.md:19-21`: ```markdown - `observe` with a natural-language goal, and any `extract`, call an LLM through the gateway. Configure API access with `agentbrowse init <apiKey>` before using them. ``` ### Technical Analysis The documented interface requires the API key to be provided as a command-line argument. Command-line secrets can be exposed through several local channels: - Shell history files. - Process-listing and process-inspection interfaces while the command runs. - Terminal session recording. - CI/CD command logs and agent execution telemetry. - Error reports or debugging output that captures the invoked command. The documentation also states that the API key is stored in a local configuration file but does not specify its location, permissions, encryption, or redaction behavior. This creates an additional uncertainty around credential-at-rest protection, although the available project files do not establish that the configuration is definitely stored insecurely. ### Attack Path 1. A user obtains a valid gateway API key and fo ...[truncated 1489 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace command-line secret entry with an interactive, non-echoing prompt. 2. Support reading the secret from standard input, for example: ```bash printf '%s' "$AGENTBROWSE_API_KEY" | agentbrowse init --api-key-stdin ``` 3. Integrate with an operating-system credential store or approved secret manager instead of persisting plaintext credentials in an ordinary configuration file. 4. If local persistence is required, create the credential file with owner-only permissions and reject files with unsafe ownership or modes. 5. Ensure `doctor`, error reporting, telemetry, and debug logs always redact API keys. 6. Avoid recommending environment variables as the sole protection because they may also be exposed through process environments or diagnostics; use them only with appropriate execution and logging controls. 7. Document key rotation and revocation procedures for suspected exposure. 8. Update `SKILL.md`, `references/commands.md`, and `references/workflow.md` to use the secure initialization mechanism consistently. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly enables screenshots and structured page extraction on arbitrary websites, but it does not clearly warn that these actions may capture sensitive on-page data such as personal information, session details, account balances, or other confidential content. In a browser automation context, that omission can lead an agent to collect or persist sensitive data without informed user awareness, especially when combined with broad instructions to inspect, extract, and debug page state.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs users to store an API key in a local config file but does not warn that this is sensitive credential material, where it is stored, what file permissions are used, or whether the value is encrypted. In a browser automation skill, this is meaningful because local config files are commonly copied into backups, logs, dotfile sync tools, or shared workspaces, which can expose the key and enable unauthorized use of the AI-assisted features or associated account resources.

Static analysis

No suspicious patterns detected.