ClawHub
Back to skill

Security audit

ui-test-agent

Security checks for vulnerabilities and agentic risk

Overview

This UI testing skill does what it says, but it stores sensitive browser evidence and creates executable replay/report files without enough safety controls.

Install only if you are comfortable with it saving browser screenshots, typed values, URLs, selectors, commands, and errors to disk. Use test accounts and staging sites where possible, keep generated reports and sessions private, and inspect generated .sh/.bat files before running them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill instructs the agent to create session files, screenshots, replay scripts, and HTML reports, which are clear file-write capabilities, yet no permissions are declared. This creates a trust and containment gap: the runtime or reviewer cannot accurately assess what filesystem access the skill needs, increasing the risk of unintended writes, overwriting user files, or storing sensitive browser artifacts without explicit approval.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The report generator interpolates untrusted session fields and CLI inputs such as test_name, description, tester, url, selector, input_value, error, and command directly into HTML attributes and element content without escaping. Because the output is an executable HTML file that users will open in a browser, a crafted session or argument can inject script or active markup, leading to stored/self-XSS, local data exposure in the browser context, or report tampering. The UI-testing context makes this more dangerous because the tool records browser interactions and error text from external web pages, so attacker-controlled page content can easily flow into the report.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script serializes session-provided step["command"] values directly into executable .sh and .bat files with no validation, escaping, trust boundary checks, or warning to the operator. In this skill's context, session data may originate from browser-driven recordings or other tool output, so persisting raw commands creates a replayable command-injection path where malicious or tampered session content can later execute arbitrary OS commands when the generated script is run.

Static analysis

No suspicious patterns detected.