AutoClaw Browser Automation

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:16 AM UTC
• Version: 6.1.2

Overview

AutoClaw is a disclosed browser-control skill, but it grants very broad, persistent browser authority and exposes unsafe local control paths that need careful review before use.

Install only in an isolated test browser profile, not a profile with email, banking, work apps, or saved sessions. Before normal use, the publisher should add authenticated pairing for MCP, remove wildcard CORS, disable autoAttachAll by default, require per-tab and per-action confirmation for cookies/sessions/JavaScript/screenshots/destructive actions, redact secrets, and replace the shell bridge with a fixed allowlisted argument-vector implementation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (7)

T09 · Insecure Skill Coding Practices

Error

• Location: mcp/dist/server.js:2199

Finding

Unauthenticated Shell Command Injection in the CLI Bridge

Content

View full analysis

{ exec(command, { timeout: 30000 }, (error, stdout, stderr) => { if (error) { reject(new Error(`CLI execution failed: ${error.message}`)); } else { resolve({ stdout: stdout.trim(), stderr: stderr.trim(), exitCode: error ? error.code : 0 }); } }); }); ``` ### Technical Analysis The `tool`, `url`, `ref`, and `text` properties originate from MCP tool arguments and are concatenated into a command passed to `child_process.exec()`. `exec()` invokes a system shell, so shell metacharacters in any untrusted argument are interpreted as commands. Wrapping some arguments in double quotes does not prevent injection. An attacker can terminate the quoted value and append shell operators. The unquoted `tool` and the special `open` or `navigate` URL path are especially direct injection points. The vulnerability is reachable through MCP interfaces that do not authenticate callers, making this a remotely triggerable loca ...[truncated 1086 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: mcp/dist/server.js:2474

Finding

Privileged MCP Tools Are Exposed Without Client Authentication

Content

View full analysis

{ res.setHeader('Access-Control-Allow-Origin', '*'); res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS'); res.setHeader('Access-Control-Allow-Headers', 'Content-Type'); if (req.method === 'OPTIONS') { res.writeHead(204); res.end(); return; } // HTTP POST for MCP tools if (req.method === 'POST' && req.url === '/mcp') { let body = ''; for await (const chunk of req) { body += chunk; } try { const msg = JSON.parse(body); if (msg.method === 'tools/call') { const toolName = msg.params?.name || ''; const toolArgs = msg.params?.arguments || {}; console.log(`[HTTP] Calling tool: ${toolName}`); try { const text = await executeTool(toolName, toolArgs); res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' }); res.end(JSON.stringify({ id: msg.id, result: { content: [{ type: 'text', text }] } })); } catch (e) { res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' }); res.end(JSON.stringify({ id: msg.id, error: { code: -32000, message: e.message } })); } return; } } catch (e) {} res.writeHead(400); res.end(JSON.stringify({ error: 'Invalid request' })); return; } }); const mcpWss = new WebSocketServer({ noServer: true }); mcpWss.on('connection', (ws, req) => { console.log(`[MCP] OpenClaw AI connected`); ws.on('message', async (data) => { let msg; try { msg = JSON.parse(data.toString()); } catch { return; } if (msg.method === 'ping') { ws.sen ...[truncated 2544 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: mcp/dist/server.js:92

Finding

Public Hard-Coded Authentication Tokens and Health-Endpoint Disclosure

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: autoclaw-plugin/background.js:435

Finding

Unrestricted CDP Command Forwarding Enables Complete Browser-Session Control

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: autoclaw-plugin/background.js:806

Finding

Permanent Authorization and Default Automatic Attachment of All Browser Tabs

Content

View full analysis

{ if (reason === 'install') { chrome.storage.local.set({ gatewayToken: BUILT_IN_TOKEN, relayPort: DEFAULT_PORT, autoAttachAll: true, openMode: 'newTab', maxTabs: 50, classifyMode: 'local' }); chrome.runtime.openOptionsPage(); } chrome.tabs.query({}).then(allTabs => { allTabs.forEach(t => t.id && setTabBadge(t.id, 'off')); }); }); ``` All tabs are attached again on browser startup: ```javascript chrome.runtime.onStartup.addListener(async () => { const allTabs = await chrome.tabs.query({}); allTabs.forEach(t => t.id && setTabBadge(t.id, 'off')); if (await isAuthValid()) { const config = await getConfig(); if (config.autoAttachAll) { setTimeout(() => attachAllTabs().catch(() => {}), 2000); } else { setTimeout(() => connectGateway().catch(() => {}), 2000); } } }); ``` New tabs are also attached automatically: ```javascript chrome.tabs.onCreated.addListener(async (tab) => { const config = await getConfig(); if (!tab.id) return; if (!(await isAuthValid())) return; setTimeout(async () => { if (tabs.has(tab.id) || tabs.size >= config.maxTabs) return; try { await connectGateway(); await attachTab(tab.id); } catch {} }, 800); }); ``` ### Technical Analysis The extension contains authorization timestamp and duration con ...[truncated 1592 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: autoclaw-plugin/manifest.json:7

Finding

Extension Requests Excessive All-Site and Debugger Permissions

Content

View full analysis

" ], "content_scripts": [ { "matches": [""], "js": ["picker.js"], "run_at": "document_end" } ] } ``` ### Technical Analysis The extension combines several highly privileged capabilities: - Chrome debugger access. - All-tab metadata access. - Bookmark read/write access. - Programmatic scripting. - Access to every HTTP and HTTPS origin. - Automatic content-script injection into every supported webpage. These permissions are broader than necessary for an automation workflow limited to pages explicitly selected by the user. The presence of `activeTab` does not constrain the extension when `` and debugger permissions already grant broader access. The manifest also injects `picker.js` into every page at `document_end`, even when the user is not actively using AutoClaw on that site. ### Attack Path 1. The user installs the extension and approves the broad permission set. 2. The extension receives access to all regular web origins and browser debugger functionality. 3. A defect or compromise in the local MCP service or extension message path is exploited. 4. The attacker uses the extension's existing privileges against any accessible origin. 5. No additional browser permission prompt is required for each site. ### Impact Assessment The excessive permissions enlarge the consequences of any extension or MCP compromise. They can expose: - Page content on all visited sites. - Browser tabs and window metadata. - Bookmarks and browsing organization. - Authenticated web sessions through debugger functi ...[truncated 156 chars]

Remediation

View remediation

` from mandatory host permissions. 2. Use optional host permissions and request access only for an origin selected by the user. 3. Inject `picker.js` only after a direct user action and only into the approved tab. 4. Separate bookmark management into an optional feature with an optional `bookmarks` permission. 5. Remove `scripting`, `windows`, or other permissions unless required by a documented operation. 6. Prefer `activeTab` for temporary access to the currently selected page. 7. Keep debugger attachment limited to user-approved tabs and detach immediately after an operation completes. 8. Document why every retained permission is required and provide a reduced-permission operating mode. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: autoclaw-plugin/background.js:143

Finding

Simplified DOM Collection Exposes Form Values Without Password or Secret Redaction

Content

View full analysis

{ if (el.offsetParent === null) return; const tag = el.tagName.toLowerCase(); let text = el.textContent?.trim() || ''; let placeholder = el.placeholder || ''; let value = el.value || ''; let id = el.id || ''; let name = el.name || ''; let type = el.type || ''; let href = el.href || ''; let classes = el.className || ''; if (text.length > 60) { text = text.substring(0, 60) + '...'; } if (!text && !placeholder && !value && tag !== 'a') { return; } interactive.push({ index: idx, tag: tag, text: text, placeholder: placeholder, value: value, id: id, name: name, type: type, href: href, classes: classes }); }); return JSON.stringify(interactive.slice(0, 50)); })() `, returnByValue: true } ); let simplifiedDOM = '[]'; if (result?.result?.value) { simplifiedDOM = result.result.value; setCachedDOM(tabId, simplifiedDOM); } return simplifiedDOM; ``` The collected result is returned over the relay: ```javascript if (msg.method === 'getSimplifiedDOM') ...[truncated 1946 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (53)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises powerful browser actions including login, form filling, JavaScript execution, cookie/localStorage access, and automation workflows, but the description does not warn users about account, privacy, or integrity risks. In context, this omission is more dangerous because the skill is explicitly designed for deep browser control and even claims persistent authorization, which could enable unintended account actions, credential handling, session theft, or destructive site interactions if misused or triggered unsafely.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

- `options.js` - Browser extension options page script

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

- `background.js` - Extension background script handling WebSocket connections

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The extension evaluates JavaScript in the page context to enumerate interactive elements and sends the resulting DOM-derived data back over the relay. Even though the output is simplified, it still discloses page structure, text, placeholders, values, IDs, names, hrefs, and classes, which can expose sensitive data from arbitrary user tabs.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The extension reads bookmark titles, URLs, parent IDs, and metadata and returns them to the relay, which exposes sensitive browsing interests and saved destinations. Because there is no visible disclosure or approval in this code path, users may be unaware that personal bookmark data is being exported.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code exposes powerful remote browser automation through relay-delivered commands, including navigation, CDP command forwarding, tab creation/closure, activation, screenshots, DOM interaction, and debugger access. In a browser extension context, this is highly dangerous because any party controlling or impersonating the local relay can drive the user's browser, access page state, and perform actions across tabs with little meaningful authorization gating.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Recorded actions and workflow steps can execute arbitrary page interactions, fill inputs, navigate, capture screenshots, scroll, wait, and close tabs without explicit user approval at execution time. In practice, this allows automation of sensitive transactions or collection of visual/page data once a tab is attached.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

On startup, the extension can automatically connect to the relay and attach to all tabs when autoAttachAll is enabled, without any clear runtime warning in this code path. Combined with debugger access, this silently broadens surveillance and control over the entire browsing session.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The configuration API returns the stored gateway token over the relay channel via getConfig, effectively disclosing the secret used to authenticate the extension to the same remote control plane. Exposing authentication material undermines any trust boundary and can enable session hijacking, relay impersonation, or unauthorized reconfiguration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest grants <all_urls> host access, allowing the extension to interact with essentially every website, while the description does not justify that breadth. In a browser automation controller, this level of access can expose page contents, session-bound data, and user activity across sites, making misuse or compromise significantly more dangerous.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Injecting a content script into every visited page at document_end gives the extension continuous visibility and influence across all browsing activity. In the context of an automation companion, this is especially risky because the script could inspect page data, manipulate forms, or relay sensitive content from arbitrary sites, far beyond a narrowly scoped feature need.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · autoclaw-plugin/popup.js (reported line 182)May include surrounding context.

js

pickerBtn.textContent = '🎯 Element Picker';
      pickerBtn.classList.remove('active');
      
      // Send message to deactivate
      const tabs = await chrome.tabs.query({ active: true, currentWindow: true });
      if (tabs[0]?.id) {
        chrome.tabs.sendMessage(tabs[0].id, { action: 'deactivatePicker' });

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · autoclaw-plugin/popup.js (reported line 201)May include surrounding context.

js

pickerBtn.textContent = '🎯 Element Picker';
      pickerBtn.classList.remove('active');
      
      // Send message to deactivate
      const tabs = await chrome.tabs.query({ active: true, currentWindow: true });
      if (tabs[0]?.id) {
        chrome.tabs.sendMessage(tabs[0].id, { action: 'deactivatePicker' });

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The configuration read path can return the full configuration object, including cloud API key fields, directly to MCP callers. In an agent-accessible server, this exposes sensitive credentials to any client able to invoke the tool, enabling downstream abuse of cloud resources and lateral access beyond the browser automation scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The login session save/restore features capture and replay authentication cookies, effectively allowing persistent session cloning. In the context of a browser automation MCP server, this materially increases the risk of account takeover, unauthorized access reuse, and secret-bearing session extraction if the tool is invoked by an untrusted client or compromised workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The bridge tool constructs and executes a shell command from tool-supplied input using child_process.exec, which expands the server's capabilities from browser control into local subprocess execution. Even with partial argument shaping, passing untrusted tool or argument data into a shell command can enable command injection or unintended local command execution, which is especially dangerous in an MCP-exposed automation server.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The lockfile pins the project to ws 8.19.0, and the provided advisory data indicates this version is affected by an uninitialized memory disclosure and a memory-exhaustion denial of service. Because ws is a network-facing WebSocket library, any service using it may expose reachable attack surface to remote clients, making the issue materially dangerous rather than theoretical.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

The package depends on the ws library, and the analysis indicates a known vulnerable resolved version with advisories for memory disclosure and denial of service. In an MCP server context, a WebSocket library is likely exposed to untrusted client input, making memory corruption or resource-exhaustion flaws materially more dangerous because they can be triggered remotely against the service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The workflow automation and file upload features are presented as convenience features without caution that they can trigger impactful real-world actions, submit data, or exfiltrate local files. In a browser automation plugin, prerecorded actions and templates can be reused at scale, increasing the risk of unintended transactions, spammy behavior, or sensitive file disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The changelog advertises privacy- and system-sensitive browser capabilities such as JavaScript execution, cookie/storage access, and full browser control without any warning, permission model, or abuse constraints. In an agent skill context, documenting these capabilities as normal features can enable unsafe use, including session theft, data extraction, or actions on behalf of the user.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README presents highly generic natural-language triggers such as 'Save this page' and 'Log me into this website' as normal activation phrases for a powerful browser-control skill. Because the skill can perform state-changing actions, broad invocation language increases the risk of accidental or prompt-injected activation from ordinary conversation, webpage content, or other untrusted text interpreted as user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly exposes capabilities to read cookies, browser storage, page content, screenshots, and saved login sessions, which are highly privacy- and security-sensitive because they can reveal authentication material, personal data, and confidential browsing content. In the context of a browser automation skill with broad tab/page control, documenting these features without clear consent, scope, and handling warnings materially increases the risk of covert credential or session theft.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes the ability to create, switch, reload, close, and attach/control all browser tabs, as well as navigate to arbitrary URLs, but does not warn that this grants broad control over the user's browsing session. This is dangerous because it expands the scope from a single intended page to potentially all open tabs, enabling surveillance, phishing navigation, or unauthorized interaction across unrelated sites.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented bookmark deletion and recursive folder removal operations are destructive and potentially irreversible, yet the skill provides no warning, confirmation expectations, or recovery guidance. In a browser-wide automation context, this can lead to large-scale user data loss if triggered accidentally or misused by a malicious workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises arbitrary JavaScript execution in pages and local file upload into browser forms without any warning about code execution, data exfiltration, or integrity risks. In a browser automation environment, these capabilities can be abused to manipulate trusted sites, extract sensitive DOM data, submit unauthorized actions, or upload unintended local files to remote services.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal, suspicious.install_untrusted_source

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: mcp/dist/server.js:2230

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: autoclaw-plugin/options.js:354

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: autoclaw-plugin/manifest.json:16