Bb Browser Openclaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:25 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned, but it asks the agent to download community website adapters and run them in your logged-in OpenClaw browser session without clearly documenting trust, provenance, or privacy boundaries.

Review and trust the adapter source before using this skill. Avoid running community adapters against sensitive logged-in accounts unless you intentionally want the adapter to access that account context, and prefer a separate browser profile or logged-out session for lower-risk use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unverified Community Adapter Supply Chain

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–19
Vulnerability Type: Unverified third-party component retrieval
Risk Level: Medium

bash

# First time: pull community adapters
bb-browser site update

Technical Analysis

The documented quick-start procedure instructs users to download community-maintained adapters with bb-browser site update. The skill does not identify an authoritative registry or repository, pin adapter versions, specify integrity hashes, require cryptographic signatures, or describe a review and approval process.

These adapters are subsequently used through OpenClaw's browser, including browser sessions authenticated to third-party websites. Consequently, compromise of the adapter distribution source or publication of a malicious adapter could introduce attacker-controlled components after the skill itself has been reviewed. The retrieved adapter content is not present in the audited project, so actual malicious behavior or code execution cannot be confirmed from this repository alone.

Attack Path

1. An attacker compromises the community adapter distribution source or succeeds in publishing a malicious or modified adapter.
2. A user follows the documented quick-start process and runs bb-browser site update.
3. The client retrieves the attacker-controlled adapter without any documented signature, checksum, source verification, or version pinning step.
4. The user invokes the affected adapter with --openclaw.
5. The adapter operates through the user's OpenClaw browser context and may interact with a website for which the user has an active authenticated session.
6. Depending on the permissions and behavior supported by the external adapter runtime, the malicious adapter could perform unintended browser actions or return manipulated data.

Impact Assessment

The affected scope includes users who update and execute community adapters. A compromised adapter ...[truncated 466 chars]

Remediation

View remediation

Remediation Suggestions

1. Document the authoritative adapter registry and source repository.
2. Pin adapters to explicitly reviewed versions or immutable commit identifiers rather than implicitly accepting the latest community release.
3. Require cryptographic signatures and verify package hashes before installation or update.
4. Present the adapter source, version, requested capabilities, and integrity status to the user before installation.
5. Require explicit confirmation for updates and provide a locked manifest of approved adapters.
6. Run adapters in a sandbox with strict origin, network, browser-tab, filesystem, and process-execution restrictions.
7. Grant each adapter access only to the website origins and browser capabilities required for its stated purpose.
8. Establish source review, publisher verification, revocation, and incident-response processes for community adapters.
9. Document how users can inspect, audit, roll back, and remove downloaded adapters.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill prominently encourages using bb-browser site commands through OpenClaw's browser and later mentions that adapters use the user's existing login state, but the description and quick-start guidance do not clearly warn users that commands may access authenticated, account-scoped data. This can lead users to run third-party adapters against sensitive logged-in sessions without understanding the privacy and data-exposure implications.

Content

No source excerpt is available for this finding.