Why this verdict
- suspicious: finding skill:skill-data/core:skill-data/core/SKILL.md:256:SUPPLY
- suspicious: finding skill:skill-data/core:skill-data/core/SKILL.md:513:SUPPLY
- suspicious: finding skill:skill-data/core:skill-data/core/references/authentication.md:174:SUPPLY
- suspicious: finding skill:skill-data/core:skill-data/core/references/commands.md:347:SUPPLY
Security findings 4
Supply chain
mediumContextual risklow confidenceThe plugin guide instructs installing credential-handling plugin executables resolved without version pins from npm or directly from GitHub owner/repo, which then run as external stdio processes holding capabilities such as credential.read.
A plain `name` or `@scope/name` resolves from npm; `owner/repo` resolves from GitHub
vector:instruction
Counter-argument considered
The auth guide concretely instructs adding plugins whose plain npm names and `owner/repo` GitHub refs resolve without any version pin and then run as external executables holding credential.read; GitHub owner/repo is not an official registry, nothing is pinned, and no declared claim covers remote acquisition, so no carve-out applies.
Supply chain
mediumContextual riskmedium confidenceThe commands reference documents agent-browser plugin add <ref> installing plugins from npm or GitHub without version pinning and writing ~/.agent-browser/config.json, acquiring unpinned remote plugin code that can later execute via the tool.
# Add a plugin from npm or GitHub (writes ~/.agent-browser/config.json; --project writes ./agent-browser.json)
vector:instruction
Counter-argument considered
The shipped command reference concretely documents `plugin add <ref>` acquiring plugins from npm or GitHub with no version pin and writing config, and the same file declares such plugins run out-of-process; unlike the tool's own quickstart install, this optional third-party (and arbitrary owner/repo) acquisition is not pinned and no declared claim covers it, so the finding stands.
Supply chain
mediumContextual riskmedium confidenceThe auth guide instructs the agent to run `agent-browser plugin add agent-browser-plugin-vault`, fetching and installing an unpinned third-party plugin package at runtime for credential handling, an undeclared remote-code install beyond the skill's stated usage-guide purpose (residue adjudicated as unexplained: open, not hidden, but the skill description does not cover runtime plugin installation).
agent-browser plugin add agent-browser-plugin-vault --name vault
vector:instruction
Counter-argument considered
The core skill body directs the agent to run a concrete `plugin add` command in the login workflow, and the artifact itself states plain names resolve from npm and run as external executables; this runtime acquisition of unpinned credential-capable code is not pinned, not a vendor tool installer, and no declared claim covers fetching plugin packages, so no gate fails.
Supply chain
mediumContextual risklow confidenceThe guide instructs the agent to fetch additional skill content from the agent-browser skill registry at runtime via unpinned `skills get` commands, an undeclared remote-instruction fetch not covered by the declared usage-guide purpose (residue adjudicated as unexplained: openly documented, not concealed, but pulling mutable external content).
agent-browser skills get electron
vector:instruction
Counter-argument considered
The skill instructs the agent to pull additional agent-facing skill content at runtime via unpinned `skills get` commands; a mutable remote-instruction fetch is neither pinned nor a vendor host installer nor covered by the declared description or any declared claim, so the finding survives all gates.
Open questions 2
What the analysis could not settle from the code alone.
How does `agent-browser skills get <name>` resolve the referenced skills (electron, slack, dogfood, vercel-sandbox, protected-vercel-deployments, agentcore) — from a remote registry, and is that content pinned or verified before the agent loads it as instructions?
Supply chain
Does `agent-browser --auto-connect state save` export cookies and storage for all origins in the debugged Chrome session or only for visited origins, which determines the reach of the documented credential export?
Credential access
Refuted findings 3
Candidates the review stage examined and rejected, kept for transparency.
Credential access
criticalRefutedlow confidenceThe skill instructs reusing the cookie store of a logged-in Chrome debugging session by exporting cookies and localStorage into a plaintext JSON state file for later automation reuse.
reuse cookies from a Chrome session you are already logged into
Why it was refuted
Reusing the user's own logged-in Chrome session into a local state file is the wrapped tool's declared auth-handling capability (the skill covers 'handling forms and auth' / 'log into a site'), and the plaintext-credential risk is declared and mitigated in the artifact itself, so the CRED harm is carved out and declared rather than undeclared exposure.
Credential access
criticalRefutedlow confidenceThe authentication guide instructs attaching to the user's Chrome via remote debugging and exporting its cookies and localStorage into a plaintext local JSON state file, exposing reusable session credentials to any local process and storing them unencrypted at rest.
agent-browser --auto-connect state save ./my-auth.json
Why it was refuted
The local-process exposure the finding claims is exactly what the artifact's own security note declares and bounds, and the export is the tool's declared auth capability performed on the user's own Chrome, session, and machine with declared mitigations (trusted-machine restriction, encryption key, deletion guidance); no third-party or exfiltration sink exists, so the claimed unmitigated credential exposure is refuted.
Supply chain
highRefutedlow confidenceThe quickstart instructs a global unpinned npm install of the agent-browser package plus its dependency installer, executing registry-supplied code on the host before the declared browser-automation task begins.
npm i -g agent-browser && agent-browser install
Why it was refuted
The cited line is the wrapped tool's own labeled '# Install once' quickstart inside a fenced install block: installing agent-browser itself and running its vendor installer is the official install path intrinsic to this usage guide's declared purpose, matching the vendor-installer-in-fenced-install-docs carve-out, so the supply-chain framing is wrong and the step is open declared quickstart content.
Coverage gaps 4
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
docs/src/app/favicon.ico
context:unanalyzable_binary binary content is only byte-scanned
examples/environments/app/favicon.ico
context:unanalyzable_binary binary content is only byte-scanned
packages/dashboard/src/app/favicon.ico
context:manifest_unparseable yaml: YAML node count exceeds 20000
pnpm-lock.yaml
