Is agent-browser safe?
https://clawhub.ai/TheSethRose/agent-browser
Agent Browser is a documentation-only skill wrapping the agent-browser CLI for headless browser automation. It contains no executable code itself, but its broad allowed-tools declaration and powerful command set — including arbitrary JS eval, network interception, cookie/session harvesting, and credential handling — create significant risk for data exfiltration and session hijacking, especially in multi-skill environments or under prompt injection attacks. The skill's clean install profile and intact canaries are offset by the inherently dangerous capabilities it exposes to the agent.
Category Scores
Findings (11)
HIGH Browser session and credential harvesting capabilities -35 ▶
The skill provides comprehensive commands to read cookies, localStorage, session storage, and save/load full browser session state. An agent following these instructions can extract authentication tokens, session cookies, and stored credentials from any website the user visits. The state save command persists this data to disk where it could be accessed by other skills or exfiltrated.
HIGH Network interception and request manipulation -30 ▶
The network route command can intercept HTTP requests and mock responses, enabling man-in-the-middle attacks. Combined with set headers, an attacker-controlled skill could redirect sensitive API calls or inject credentials into requests to attacker-controlled servers.
HIGH Arbitrary JavaScript execution via eval command -30 ▶
The eval command allows executing arbitrary JavaScript in the browser context. This can access the full DOM, cookies, localStorage, and make network requests. A prompt injection attack could leverage this to exfiltrate any data visible to the browser.
HIGH Broad tool permission with powerful subcommands -30 ▶
The skill declares allowed-tools: Bash(agent-browser:*) which grants the agent permission to run any agent-browser subcommand via Bash without individual command approval. This includes dangerous commands like eval, network route, set credentials, and state save that could be weaponized through social engineering or prompt injection.
MEDIUM npm global install with unknown install scripts -20 ▶
The installation step npm install -g agent-browser executes whatever preinstall/postinstall scripts the npm package contains. The agent-browser install --with-deps further installs system-level dependencies. The skill itself contains no executable code, but delegates all execution to this externally-managed npm package.
MEDIUM CDP port connection enables cross-browser-instance access -10 ▶
The --cdp <port> flag allows connecting to a Chrome DevTools Protocol endpoint on any port. If other browser instances are running with remote debugging enabled, this skill could attach to them and access their pages, cookies, and session data.
MEDIUM Powerful automation toolkit increases attack surface when combined with other skills -20 ▶
While each capability (browsing, form filling, cookie access) is legitimate for browser automation, the combination creates a comprehensive credential theft and session hijacking toolkit. A second skill with filesystem access could exfiltrate saved session state. The skill is most dangerous in multi-skill environments.
MEDIUM Credential-handling examples normalize sensitive operations -15 ▶
The SKILL.md includes examples that fill in username/password fields and save authentication state. This normalizes the agent handling credentials directly, making social engineering attacks easier — a user might not question the agent accessing login pages and saving auth state.
LOW Host agent framework accessed .env and .aws/credentials during install -10 ▶
Filesystem monitoring shows /home/oc-exec/.env and /home/oc-exec/.aws/credentials were accessed during the audit. This appears to be the host OpenClaw agent framework reading its own configuration rather than the skill itself, but it is notable that these sensitive files were touched during the skill installation context.
INFO No executable code in skill repository 0 ▶
The skill contains only markdown documentation (SKILL.md, CONTRIBUTING.md) and JSON metadata files. No executable code, git hooks, submodules, or symlinks are present. All functionality is delegated to the externally-installed agent-browser npm package.
INFO Clean network profile during installation 0 ▶
No outbound network connections were detected during the clone and install phase. No firewall-blocked connections. The skill installation was purely local.