Skill

agent-browser

skill:sipeed/picoclaw#agent-browser

Browser automation via agent-browser CLI. Use when the user needs to navigate websites, fill forms, click buttons, take screenshots, extract data, or test web apps.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:31 UTC at bbf6893

findings

high

highest severity

threat classes

1,393

files scanned

27/27

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:workspace/skills/agent-browser:workspace/skills/agent-browser/SKILL.md:1:SUPPLY
suspicious: finding skill:workspace/skills/agent-browser:workspace/skills/agent-browser/SKILL.md:83:CRED

Security findings 2

Credential access

highContextual risklow confidence

The skill's Authentication section instructs importing the user's running Chrome session state (live cookies/auth) into a local auth.json via `agent-browser --auto-connect state save ./auth.json`, an undeclared credential-access capability reaching beyond the declared navigate/fill/click/screenshot verbs, though it is openly documented as an option for testing authenticated web apps.

workspace/skills/agent-browser/SKILL.md:83

# Option 1: Import from user's running Chrome

vector:instruction

Counter-argument considered

The Authentication section instructs exporting live session state from the user's running Chrome into a local auth.json; credential/session capture is absent from the declared verb set and no carve-out or mitigation covers it, and open documentation in the body is not accepted as neutralizing harm.

Supply chain

mediumContextual risklow confidence

The skill's frontmatter metadata directs a global, unpinned npm installation of the package 'agent-browser', so setup downloads and installs whatever code the public registry currently serves under that name for later execution.

workspace/skills/agent-browser/SKILL.md:1-5

metadata.nanobot.install[0].package: agent-browser

vector:metadata

Counter-argument considered

The manifest install directive is global and version-unpinned, so the pinned-official-registry carve-out does not apply, and the body's agent-facing 'do not install at runtime' directive does not govern the setup layer that consumes this metadata; its open declaration in the manifest is disclosure, which is not a carve-out.

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Supply chain

mediumRefutedlow confidence

The skill directs a version-unpinned global npm installation of the third-party 'agent-browser' package (plus its 'install' subcommand, which fetches a browser runtime) as a setup step, giving an unpinned dependency install-time code execution on the agent host.

workspace/skills/agent-browser/SKILL.md:9

Install: `npm i -g agent-browser && agent-browser install`.

Why it was refuted

The mandatory pre-flight directive in the same section neutralizes the claimed agent-directed install: the skill requires verifying availability first, states the CLI is only available in the heavy container image, and explicitly forbids runtime installation, so the Install line describes image provisioning rather than an operative step, and the command is openly stated in the body.

Coverage gaps 3

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned

scripts/icon.icns

context:unanalyzable_binary binary content is only byte-scanned

web/backend/icon.ico

context:unanalyzable_binary binary content is only byte-scanned

web/frontend/public/favicon.ico