Agent Economy ReportAgent Economy ReportCAUTION version 0.1.0 · audited 2026-09-17
This package is a markdown skill card that documents how to use an existing command-line tool called agent-browser for headless browser automation. It explains commands for opening URLs, reading accessibility snapshots, clicking and filling form fields, managing cookies and localStorage, saving and loading browser state, taking screenshots or PDFs, and mocking network requests. The package itself contains no executable code, no obfuscation, and no hidden network destinations; the network references are the tool homepage, documentation links, or example pages. The main concerns are that following the instructions requires shell access, installs a global npm package that downloads Chromium, can save or load authenticated browser state, and can operate on logged-in websites. The published risk notes explicitly warn about these issues. I found no evidence of prompt injection, credential theft, payment redirection, or persistence outside the documented browser state files.
| Declared purpose | Headless browser automation CLI optimized for AI agents with accessibility tree snapshots and ref-based element selection |
| Observed behavior | The files contain only documentation and metadata. The skill instructs the agent to run shell commands using the agent-browser CLI: open URLs, take accessibility snapshots, click/fill/type/select elements by ref, wait for elements or network idle, manage sessions, save/load browser state, take screenshots/PDFs, route or mock network requests, and read or set cookies/localStorage. It also instructs installation with npm install -g agent-browser followed by agent-browser install to download Chromium. No executable scripts, encoded payloads, hidden endpoints, or direct credential/payment operations are present. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | The skill instructs the agent to run agent-browser in bash-style shell commands throughout SKILL.md, for example lines 29, 34, 57, and 119, so shell execution is required. |
| network | needed | The documented CLI opens external URLs such as https://example.com and https://www.google.com, waits for network idle, and can block, mock, or view network requests. |
| browser | needed | The whole skill drives a headless browser: open, snapshot, click, fill, type, hover, check, select, press, scroll, drag, screenshot, and PDF commands are documented. |
| filesystem_read | needed | The skill tells the agent it can load saved browser state with 'agent-browser state load auth.json', which reads files from disk. |
| filesystem_write | needed | The documented commands write state files, screenshots, and PDFs: 'agent-browser state save auth.json', 'agent-browser screenshot page.png', and 'agent-browser pdf page.pdf'. |
| credentials | needed | The CLI can save and load browser cookies and storage that may contain authenticated sessions; SKILL.md line 106 says 'Save cookies/storage' and line 107 says 'Load (skip login)'. |
| install_packages | needed | SKILL.md instructs 'npm install -g agent-browser' and 'agent-browser install' to download Chromium, which are global installation steps. |
| severity | finding |
|---|---|
| info | Declared purpose This description matches the observed browser-automation commands. SKILL.md:3 description: Headless browser automation CLI optimized for AI agents with accessibility tree snapshots and ref-based element selection |
| info | CLI requirement and external homepage The skill declares it requires the agent-browser command and links to the upstream GitHub repository. SKILL.md:4 metadata: {"clawdbot":{"emoji":"🌐","requires":{"commands":["agent-browser"]},"homepage":"https://github.com/vercel-labs/agent-browser"}} |
| info | Example external navigation Documents opening an external site, consistent with browser automation. SKILL.md:29 agent-browser open https://example.com |
| info | Form interaction command Shows filling a text field by accessibility ref. SKILL.md:58 agent-browser fill @e3 "text" |
| low | JavaScript expression execution The command accepts a JavaScript expression evaluated in the page; this is a browser-automation capability that could execute page-context code. SKILL.md:93 agent-browser wait --fn "window.ready === true" |
| medium | Can save browser session state Saving cookies/storage to a file can expose authenticated sessions if the file is mishandled; skill-card.md warns about this. SKILL.md:106 agent-browser state save auth.json # Save cookies/storage |
| medium | Can load browser session state Loading auth state can operate under saved login credentials and bypass login; this needs careful handling. SKILL.md:107 agent-browser state load auth.json # Load (skip login) |
| low | Writes screenshot files The command writes a screenshot PNG to disk. SKILL.md:112 agent-browser screenshot page.png |
| low | Writes PDF files The command writes page content to a PDF file. SKILL.md:114 agent-browser pdf page.pdf |
| medium | Network interception and blocking The CLI can intercept network requests, which is powerful but documented for testing and ad blocking. SKILL.md:119 agent-browser network route "**/ads/*" --abort |
| medium | Can read browser cookies The command reads cookies, which may include session or authentication cookies. SKILL.md:126 agent-browser cookies |
| medium | Can read localStorage The command reads localStorage values, which may contain sensitive site data. SKILL.md:128 agent-browser storage local key |
| info | Example with Google Another example external URL, consistent with the declared browser-automation purpose. SKILL.md:168 agent-browser open https://www.google.com |
| medium | Global package installation This installs agent-browser globally via npm, a supply-chain and local execution risk noted in skill-card.md. SKILL.md:197 npm install -g agent-browser |
| medium | Downloads Chromium The CLI downloads Chromium, necessary for browser automation but involving a large binary download. SKILL.md:198 agent-browser install |
| info | Publisher risk warning The publisher discloses the main credential/session risk. skill-card.md:24 Risk: Saved browser state, cookies, and localStorage can expose authenticated sessions or sensitive data. |
| info | Publisher installation risk warning The publisher warns about global installation exposure. skill-card.md:28 Risk: Global CLI installation can expand local execution and supply-chain exposure. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| example.com | not in the service index | SKILL.md:29 |
| github.com | not in the service index | SKILL.md:4 |
| www.google.com | not in the service index | SKILL.md:168 |
| Binaries invoked | bash, npm |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 206 | 9643b9c65476eedd… |
_meta.json | 6 | a73cb4d335bf96b2… |
skill-card.md | 57 | db819401ee97003c… |
For agents
JSON: https://agenteconomy.report/k/agent-browser-clawdbot.audit.json · badge: https://agenteconomy.report/k/agent-browser-clawdbot.audited.svg ·
skill rating: /k/agent-browser-clawdbot · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).