ClawHub
Back to skill

Security audit

slbrow-skill

Security checks for vulnerabilities and agentic risk

Overview

This browser-control skill is mostly disclosed, but it needs Review because it can access browser history and page content, close or manipulate tabs, and relies on an unpinned local server package.

Install only if you intentionally want an agent to control a real browser. Use a separate browser profile, pin and verify the SLBrow server package and extension, keep the server bound to localhost, and require explicit user approval before history searches, page extraction, tab closing, navigation in active sessions, or Seelink/VAI player actions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned npm Package Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

markdown
1. **SLBrow server** running: `npx slbrow` or `npm start` in `ai/slbrowmcp/slbrow-mcp/`

Technical Analysis

The documented npx slbrow command can retrieve the currently published slbrow package from the configured npm registry and execute it. The instruction does not specify an exact package version, integrity hash, lockfile, trusted registry, or reviewed source revision.

As a result, the code executed by users may differ from the code assessed during this audit. npm package lifecycle scripts and the package's runtime entry point can execute with the privileges of the invoking user. The retrieved slbrow implementation is not present in this project, so its behavior cannot be verified from the audited files.

This is a supply-chain exposure rather than evidence that the current npm package is malicious.

Attack Path

  1. An attacker compromises the npm account, publishing pipeline, dependency chain, or registry source associated with slbrow.
  2. The attacker publishes a malicious or backdoored release under the same package name.
  3. A user follows the prerequisite instructions and runs npx slbrow.
  4. npx resolves and downloads the unpinned package version from the configured registry.
  5. Package lifecycle or runtime code executes under the user's account.
  6. The malicious release may access data and resources available to that account or alter the local environment.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running npx. Depending on that user's permissions and environment, the malicious package could read accessible files and credentials, modify user-owned data, make network requests, or install additional software.

The affected ...[truncated 257 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact, reviewed version instead of using an unversioned command, for example:

    bash
    npx --package=slbrow@X.Y.Z slbrow

  2. Document the expected package provenance, official registry, publisher, and source repository.

  3. Provide a lockfile with verified integrity metadata and require deterministic installation.

  4. Install the dependency separately before execution and disable lifecycle scripts where compatible:

    bash
    npm install --ignore-scripts --save-exact slbrow@X.Y.Z

  5. Review the pinned package source, transitive dependencies, lifecycle scripts, and runtime entry point before recommending execution.

  6. Prefer vendoring the reviewed server implementation or referencing an immutable source revision and verified artifact checksum.

  7. Use a non-privileged account or isolated environment and grant the browser service only the permissions required for its documented functions.

  8. Establish an update process in which new package versions are reviewed and their integrity values updated explicitly.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Access to browser history is highly privacy-sensitive because it reveals habits, accounts, research topics, and potentially regulated or confidential interests. Without a user-facing warning, users and calling agents may not understand that invoking this tool exposes historical browsing data beyond the current page.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill exposes network-capable behavior through MCP and direct HTTP curl usage but does not declare any explicit tool scope such as permissions or allowed-tools. This increases the chance that an agent will invoke browser/network actions more broadly than intended, reducing policy enforceability and making unintended data access or web interaction easier.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: slbrow-skills
description: Browser automation via SLBrow MCP and HTTP API. Use when the user needs to navigate pages, analyze content, manage tabs, search history, extract text, or control the browser. Supports both MCP tools and direct curl commands. Requires SLBrow server running and browser extension installed.
---

# SLBrow Browser Automation (Skills for Browser)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation language is broad enough to match many ordinary browsing tasks, from navigation to extraction to history search, which can cause over-invocation of a powerful skill. In agent systems, overly broad routing increases the likelihood that privacy-sensitive browser capabilities are used when a narrower or safer skill would suffice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises browser history search and content extraction but provides no privacy warning, consent requirement, or handling guidance for sensitive data. Because browser history, selected text, and extracted page content may contain personal, credential, or business-sensitive information, omission of safeguards materially raises the risk of unauthorized collection or disclosure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

Using npx slbrow without a pinned version allows the latest published package to be fetched and executed at runtime, creating a supply-chain risk. If the package is compromised or updated with malicious behavior, users may execute attacker-controlled code locally with the privileges of the invoking environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The troubleshooting guidance again instructs users to run npx slbrow without version pinning, repeating the same supply-chain exposure. Repetition in operational guidance makes unsafe installation practices more likely to be followed in real deployments.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL_COMPACT.md (reported line 7)May include surrounding context.

md
- **Content**: `page_navigate` → `page_analyze`(intent_hint) → `page_extract_content`.
- **Forms**: `page_analyze`(intent_hint:"form submit") to get element IDs, then interact via element IDs.
- **VAI**: `get_page_seelink_player_list` first to get player IDs/count → `use_seelink_players_ai`(ai_function_name, player_position_list OR player_id_list, not both). Functions: reduce_fog, face_mosaic, dark_reduce, human_outline, vechicle_outline, none. Call separately per function.
- **Fallback (no MCP tools)**: `curl -X POST http://localhost:5556/api/execute -H 'Content-Type: application/json' -d '{"tool":"use_seelink_players_ai","args":{"player_position_list":[0],"ai_function_name":"face_mosaic"}}'`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation describes potentially destructive browser actions such as navigating the current tab and closing tabs without warnings or confirmation expectations. In an autonomous-agent context, these actions can interrupt user workflows, destroy unsaved state, or redirect active sessions in ways the user did not intend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documented history search, selected-text retrieval, and page-link extraction operations can expose sensitive browsing data, private content, and behavioral information, yet the reference includes no warning, consent model, or data-handling guidance. In an agent setting, such omissions increase the chance of silent collection or over-broad access to user data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The API reference exposes VAI/Seelink player AI-control capabilities that are outside the stated browser-automation scope of the skill. This scope expansion is security-relevant because it enables manipulation of external video/player content and can cause privacy, compliance, or unauthorized-action risks if an agent invokes these tools without explicit user understanding and authorization.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 145)May include surrounding context.

{ "status": "ok", "ws_clients": 1 }

text

## cURL Examples

```bash
# Navigate to a URL

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Tab-closing is a destructive action that can disrupt user workflows, lose transient page state, or interfere with ongoing activity. Without a warning or explicit invocation constraint, an agent may close the wrong tab(s) or perform cleanup actions the user did not intend.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

History-search exposes sensitive browsing metadata and interests, yet the manifest provides no privacy boundary, trigger condition, or consent expectation. In an agent setting, broadly described access can lead to over-collection of user data and retrieval unrelated to the active task.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is presented as browser automation and content analysis, but it also exposes unrelated video-player AI manipulation functions. This scope mismatch increases the chance that an agent or user invokes sensitive capabilities unexpectedly, undermining principle of least privilege and making review, consent, and policy enforcement harder.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The presence of AI video-processing controls in a browser automation skill is context-inappropriate and can mislead operators about what the skill is capable of doing. Hidden or unexpected media-manipulation functions broaden attack surface and can enable unauthorized surveillance, obfuscation, or content alteration workflows in environments that only expected page-navigation tools.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

Selected-text retrieval can capture sensitive user-highlighted content, but the manifest does not state when it is appropriate to call or what consent is required. This ambiguity can cause an agent to read user selections opportunistically rather than only when explicitly requested.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The description and parameter help include Chinese text such as "宫格", "去雾", and "人脸打码" alongside English, but there is no indication that multilingual output is optional or user-selected. This can violate language/locale expectations where skills should not impose a locale without opt-in.

Content

No source excerpt is available for this finding.