Agent Browser Xyhh

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:19 AM UTC
• Version: 1.0.0

Overview

This is a coherent browser automation skill, but users should handle its global install and saved browser sessions carefully.

Install this only if you trust the npm package/source repository and can run it in a low-risk environment. Treat screenshots, PDFs, recordings, cookies, localStorage, basic-auth values, headers, and saved state files such as auth.json like credentials, especially when using real accounts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 16-18 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable Code**: ```bash npm install -g agent-browser agent-browser install agent-browser install --with-deps ``` ### Technical Analysis The installation instructions globally install `agent-browser` without specifying an exact, previously audited version or verifying package integrity. The code ultimately executed by these commands can therefore change independently of the reviewed Skill. npm installation may execute package lifecycle scripts under the privileges of the invoking user. After installation, the instructions also execute package-provided installation commands. The `--with-deps` option may install or modify additional operating-system dependencies, potentially requiring elevated privileges depending on the environment. The project does not include the dependency's source code, a lockfile, an integrity hash, or another mechanism that constrains the installed artifact to the version covered by this audit. This finding does not establish that the current upstream package is malicious; it identifies an unsafe and mutable supply-chain trust boundary. ### Attack Path 1. An attacker compromises the npm package, its publishing account, an upstream dependency, or the relevant distribution channel. 2. The attacker publishes a malicious or compromised release under the expected package name. 3. A user follows the documented command without specifying a version. 4. npm resolves and installs the attacker-controlled release globally. 5. Malicious npm lifecycle scripts or package code execute with the invoking user's privileges. 6. The user executes `agent-browser install` or `agent-browser install --with-deps`, providing an additional execution opportunity and potentially permitting broader system modifications. ### Impact Assessment Successful expl ...[truncated 667 chars]
• Remediation: ## Remediation Suggestions - Pin `agent-browser` to an exact version that has been reviewed, rather than relying on npm's current default version resolution. - Verify the downloaded artifact using npm lockfile integrity metadata, a documented cryptographic checksum, or an equivalent reproducible verification mechanism. - Document the expected npm publisher and canonical source repository so users can verify package provenance. - Prefer a project-local, isolated installation over a global installation where feasible. - Disable npm lifecycle scripts during installation when they are unnecessary, and separately review any scripts that must execute. - Document precisely what `agent-browser install` and `--with-deps` download or modify before recommending their use. - Avoid running installation commands with administrative privileges unless strictly required. - Use a sandbox, container, or dedicated low-privilege account when installing and operating browser-automation dependencies.

T08 · Insecure Dependencies

Warning

• Location: CONTRIBUTING.md:22
• Finding: Use of the Mutable npm Latest Release in Troubleshooting Instructions## Vulnerability Details **File Location**: `CONTRIBUTING.md`, lines 22-25 **Vulnerability Type**: Explicit installation of an unaudited latest dependency release **Risk Level**: Medium **Vulnerable Code**: ```markdown 1. Install the latest version ```bash npm install -g agent-browser@latest ``` ``` ### Technical Analysis The contribution guide explicitly instructs users to install the package version referenced by the mutable `latest` npm distribution tag. That tag can be changed after this Skill has been reviewed, so the effective installation payload is not constrained to an audited release. A global npm installation can run package lifecycle scripts and place executable files into the global Node.js environment. Consequently, trusting a mutable distribution tag creates a supply-chain execution path from the package registry to the local machine. The repository supplies no exact version, integrity value, signature-verification procedure, or lockfile for this command. This finding concerns the unsafe dependency-resolution practice and does not assert that the package currently referenced by `latest` is malicious. ### Attack Path 1. An attacker gains control of the package publisher account, compromises an upstream dependency, or otherwise causes a malicious release to be published. 2. The compromised release is assigned the npm `latest` distribution tag. 3. A contributor follows the issue-reporting prerequisite and runs `npm install -g agent-browser@latest`. 4. npm downloads the newly tagged release rather than a version previously reviewed with the Skill. 5. Package lifecycle scripts or installed executables run attacker-controlled code with the contributor's privileges. 6. Because the installation is global, malicious files or executables may affect later invocations outside the immediate troubleshooting session. ### Impact Assessment Exploitation could provide arbitrary code execution as the a ...[truncated 442 chars]
• Remediation: ## Remediation Suggestions - Replace `agent-browser@latest` with an exact, reviewed package version. - Update the pinned version only through a controlled dependency-review process. - Provide integrity or signature-verification instructions for the approved package artifact. - Prefer an isolated local installation, container, or disposable environment instead of modifying the global npm environment. - Advise contributors not to use administrative privileges for npm installation. - Where practical, install with lifecycle scripts disabled and enable only scripts that have been explicitly inspected and documented. - Record the approved package version and provenance in repository-controlled metadata so troubleshooting instructions remain reproducible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Self-Modification

High

• Category: Rogue Agent

Content

## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

agent-browser open <url>        # Navigate to page
agent-browser snapshot -i       # Get interactive elements with refs
agent-browser click @e1         # Click element by ref
agent-browser fill @e2 "text"   # Fill input by ref
agent-browser close             # Close browser
```

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly documents saving screenshots, PDFs, videos, and exported session state to disk but gives no warning that these artifacts can contain sensitive page contents, authentication data, or user-entered secrets. In an agent setting, this increases the chance that credentials, PII, or internal application data are silently persisted and later exposed through logs, shared workspaces, or reused files.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The recording feature is described as preserving cookies and storage from the current session, which means a new recording context can inherit authenticated state and private browser data. Without a user-facing privacy warning, an agent may record privileged pages or propagate sensitive session material into outputs or subsequent contexts unexpectedly.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill includes commands for setting arbitrary HTTP headers and basic-auth credentials but omits warnings about passing secrets on the command line. Command-line secrets can be captured in shell history, process listings, agent traces, and logs, making credential disclosure likely in shared or instrumented environments.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill exposes direct inspection and manipulation of cookies, localStorage, and saved session state, all of which commonly contain authentication tokens, CSRF material, and other sensitive data. In an agent workflow, these commands materially lower the barrier to extracting, persisting, or replaying account access if guardrails and warnings are absent.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state
```

## Example: Form submission

• Confidence: 91% confidence
• Finding: Saved browser state enables session persistence across runs, which can preserve authenticated access beyond the original interaction. In a browser automation skill, this is legitimate functionality, but without warnings or constraints it can lead to token reuse, accidental privilege carryover, or theft of exported session files.

Session Persistence

Medium

• Category: Rogue Agent

Content

agent-browser wait --url "/dashboard"
agent-browser state save auth.json

# Later sessions: load saved state
agent-browser state load auth.json
agent-browser open https://app.example.com/dashboard
```

• Confidence: 93% confidence
• Finding: The authentication example normalizes saving and later loading an authenticated browser state file, which can encourage agents to persist login sessions without highlighting the risk of replayable credentials. Because the example is specifically about dashboard access after login, the context makes the session-reuse risk more concrete and more dangerous than a generic state-management mention.

Static analysis

No suspicious patterns detected.