ClawHub
Back to skill

Security audit

Browser Harness

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is mostly purpose-aligned, but it asks users to install mutable third-party code and includes under-explained local and cloud browser access that can expose sensitive browsing data.

Install only if you are comfortable trusting the external browser-harness repository at install time. Prefer a pinned release or reviewed commit, use a separate browser profile with no unrelated logged-in sessions, avoid remote cloud mode unless you understand and trust the provider, and do not expose sensitive pages through screenshots or JS extraction.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:13
Finding

Unpinned Remote Code Retrieval and Local Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–15
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
git clone https://github.com/browser-use/browser-harness
cd browser-harness
uv tool install -e .

Technical Analysis

The Skill instructs users to clone the default branch of an external Git repository and immediately install it in editable mode. It does not pin the dependency to a reviewed commit hash or signed release.

As a result, the code installed when the instructions are followed may differ from the code present when the Skill was audited. Package installation can execute attacker-controlled build hooks or otherwise install executable components. The installed browser automation tool also receives access to a local browser debugging interface, increasing the sensitivity of an upstream compromise.

This behavior exceeds a strict least-privilege implementation because the declared browser-automation functionality does not require trusting an unrestricted, mutable upstream revision at installation time.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or its default branch.
  2. The attacker adds malicious package code, installation hooks, or runtime behavior.
  3. A user follows the Skill instructions and clones the mutable default branch.
  4. The user runs uv tool install -e ., processing or installing the attacker-controlled code.
  5. The malicious component executes with the user's privileges during installation or later invocation.
  6. It may access local files, environment variables, browser debugging data, authenticated browser sessions, or network resources available to that user.

Impact Assessment

Successful exploitation can result in arbitrary code execution with the privileges of the user performing the installation. Because the installed component is intended to control a ...[truncated 254 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the repository to a specifically reviewed commit hash or a signed, immutable release tag.
  • Publish and verify a cryptographic checksum or signature before installation.
  • Avoid editable installation for end users; use a locked, reproducible package artifact.
  • Review package metadata, build hooks, and transitive dependencies before distribution.
  • Install the tool in an isolated environment under a non-administrative account.
  • Use a dedicated browser profile containing no unrelated authenticated sessions or sensitive data.
  • Document the exact reviewed version and establish a controlled process for dependency updates.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:72
Finding

Underspecified Remote Browser Mode May Transmit Sensitive Browser Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 72
Vulnerability Type: Insecure handling of remote browser access and API credentials
Risk Level: Medium

Vulnerable Code:

text
- **云端浏览器**：设置 `BROWSER_USE_API_KEY` 和 `start_remote_daemon()` 可用远程浏览器

Technical Analysis

The Skill instructs users to place an API key in the BROWSER_USE_API_KEY environment variable and invoke start_remote_daemon() to use a remote browser. It does not identify the remote service, destination endpoints, transport guarantees, data transmitted, retention policy, or authorization boundaries.

Browser automation can process sensitive page content, entered data, session state, and authenticated actions. Moving this functionality to a remote service introduces a network trust boundary that is not explained to the user. The instructions also do not establish whether the API key is narrowly scoped or how it should be protected from child processes and diagnostic output.

The file does not explicitly direct the API key or browser data to an attacker-controlled endpoint, so direct credential exfiltration is not established. The risk arises from opaque remote processing and insufficient security guidance.

Attack Path

  1. A user stores a valid service credential in BROWSER_USE_API_KEY.
  2. The user invokes start_remote_daemon() as instructed.
  3. Dependency-controlled code establishes a connection to an unspecified remote service.
  4. Browser tasks, URLs, page content, screenshots, or interaction data may be processed remotely.
  5. If the service, dependency, endpoint configuration, or account is compromised, the API credential and remotely processed browser information may be exposed or misused.

Impact Assessment

Potential exposure includes visited URLs, extracted page text, screenshots, user-supplied form data, and actions performed through the remote browser. A compromised API key could permit unauthorized u ...[truncated 202 chars]

Remediation
View remediation

Remediation Suggestions

  • Document the exact remote service, network endpoints, provider identity, and transport-security requirements.
  • Clearly describe which browser data is transmitted, where it is processed, how long it is retained, and who can access it.
  • Keep remote mode disabled by default and require explicit user consent before transmitting page content or screenshots.
  • Use narrowly scoped, revocable API credentials and provide secure setup and rotation instructions.
  • Prevent credentials from appearing in logs, command output, screenshots, or error reports.
  • Prefer local CDP operation when remote processing is unnecessary.
  • Add warnings against using remote mode for pages containing credentials, financial information, private communications, or other sensitive data unless the service is explicitly trusted and approved.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says the skill triggers when the user needs to 'open a webpage and take a screenshot,' 'extract webpage dynamic content,' 'look at JS-rendered pages,' or 'automate the browser.' These are broad natural-language conditions without explicit boundaries or exclusion examples, which could overlap with many ordinary browsing-related requests and cause unintended invocation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is presented as local CDP browser control, but the documentation also enables a remote cloud browser daemon via API key. That materially changes the trust boundary: browsing data, page contents, credentials, and automated actions may leave the user's machine without the manifest clearly disclosing that expanded capability.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documented cloud browser/API-key feature exceeds the stated purpose of local browser automation through a loopback CDP connection. Undocumented capability expansion increases the chance of misuse, accidental data exposure, or policy bypass because users and downstream systems may assume all activity remains local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Referencing remote browser mode and API key usage without warning that data may leave the local machine creates a meaningful confidentiality risk. Users may expect local-only automation because the skill centers on connecting to a locally running browser, yet remote mode could expose page contents, session state, and interaction data to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill's descriptive natural-language content is presented in Chinese, with no indication that the language is optional or that the skill is intended only for a Chinese-language environment. This can violate language/locale policy when users are not given a choice or informed of a justified regional restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.