ClawHub
Back to skill

Security audit

Browser Use Pro

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill has a coherent purpose, but it gives broad control over logged-in browser sessions and sends browsing context to an external AI service with incomplete safety scoping.

Review before installing. Use this only in a trusted local environment, prefer isolated Playwright/browser profiles over your main Chrome profile, restrict allowed domains, disable vision when secrets are involved, close any debug-enabled Chrome immediately after use, and avoid putting real passwords directly into prompts or saved scripts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:40
Finding

Unpinned Third-Party Dependencies Are Installed and Executed

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:51
Finding

Unauthenticated Chrome DevTools Endpoint Exposes an Authenticated Browser Session

Content
View full analysis
Please quit Chrome completely (Mac: Cmd+Q), then tell me "done" After user confirms: ```bash /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --remote-debugging-port=9222 & ``` Verify: `curl -s http://127.0.0.1:9222/json/version` ``` The endpoint is subsequently consumed as follows at lines 80-81: ```python # Mode B: Real Chrome (user must launch with --remote-debugging-port=9222) # browser = Browser(cdp_url="http://127.0.0.1:9222") ``` ### Technical Analysis Chrome DevTools Protocol provides extensive browser-control capabilities, including page inspection, navigation, script execution in page contexts, and automation of actions performed through authenticated websites. The instructions deliberately use a real Chrome session when the user's existing login state is needed. The documented command enables a predictable debugging endpoint on port `9222` without endpoint authentication. The instructions do not require an isolated temporary Chrome profile, a randomized port, listener-address verification, or immediate shutdown after the workflow. Consequently, another local process able to connect to the endpoint while it is active may attempt to control or inspect the browser. User confirmation before launching Chrome reduces the risk of silent activation but does not protect the endpoint after it has been started. ### Attack Path 1. The user selects Mode B to automate a website using an authenticated Chrome session. 2. The user launches Chrome with `--remote-debugging-port=9222` as instructed. 3. Chrome exposes the CDP service on the predictable port without application-level authentication. 4. A malicious or compromised local process discovers the endpoint by probing port `9222` or requesting `/json/version`. 5. T ...[truncated 964 chars]
Remediation
View remediation
``` 2. Explicitly bind the debugging service to the loopback interface and verify the actual listener address before use. 3. Select a random unused port instead of the predictable port `9222`. 4. Restrict the temporary profile to only the accounts and websites needed for the current task. 5. Close the debug-enabled Chrome process immediately after automation completes, including failure and cancellation paths. 6. Delete the temporary browser profile after confirming that no required data remains. 7. Display a clear warning that CDP grants broad control over the browser and must not be exposed to untrusted local users, containers, or networks. 8. Where practical, prefer Playwright's isolated browser contexts over CDP access to a user-authenticated Chrome instance. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The document says the LLM never sees real credentials because of sensitive_data, but the guidance also shows credentials embedded directly in the task text as placeholders. This creates a dangerous pattern: users may copy the example and substitute real credentials into the prompt body, causing secrets to be exposed to the LLM or logged in scripts. In this skill context, credential handling is central, so ambiguous examples materially increase risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill claims 'No telemetry' while also stating that step-by-step browser reasoning is sent to an external LLM API. Even if the author means there is no vendor-specific analytics collection, data is still transmitted off-host, which can mislead users about privacy exposure during browser automation. In a browser automation skill, this matters because prompts, page content, and possibly sensitive workflow data may be sent to the model provider.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

text
Verify: `curl -s http://127.0.0.1:9222/json/version`

### 4. Write Script and Run
Write script to user's workspace, then:
```bash
source ~/browser-use-env/bin/activate

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill is designed to send browser-automation reasoning to an external API endpoint (https://api.openai.com/v1). This is not inherently malicious, but it is a real data egress path: task details, extracted page content, and other workflow context may leave the local machine. Because the skill is intended for login flows and multi-step web tasks, the surrounding context raises the sensitivity of transmitted data.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
llm = ChatOpenAI(
        model="gpt-4o-mini",
        api_key="<YOUR_API_KEY>",  # From env var or user config
        base_url="https://api.openai.com/v1",
    )

    # Mode A: Built-in Chromium

Static analysis

No suspicious patterns detected.