SurfAgent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:33 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is coherent, but it needs Review because it gives mutable external components broad control of a real logged-in Chrome profile.

Install only if you are comfortable giving SurfAgent and its MCP server control over a real Chrome profile. Prefer a dedicated Chrome profile or low-privilege accounts, avoid sensitive sites unless necessary, verify the desktop app source, pin reviewed package versions where possible, and require explicit confirmation before purchases, messages, settings changes, cookie edits, or form submissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:32

Finding

Unpinned npm Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:32, README.md:24, and README.md:49
Vulnerability Type: Unpinned third-party package execution
Risk Level: High

Vulnerable Code

SKILL.md:32:

bash

hermes mcp add surfagent --command npx --args -y surfagent-mcp

README.md:24:

bash

npx clawhub@latest install surfagent

README.md:49:

bash

hermes mcp add surfagent --command npx --args -y surfagent-mcp

Technical Analysis

The documented installation commands instruct users to fetch and execute mutable third-party npm packages without pinning an exact reviewed version or verifying package integrity.

The npx -y surfagent-mcp command can automatically download the package and run its lifecycle or runtime code. Likewise, npx clawhub@latest explicitly selects the latest available release. The code ultimately executed can therefore change after this skill package has been audited.

If an npm publisher account, package, release process, or upstream dependency is compromised, a malicious package version could execute arbitrary commands under the operating-system account that invokes npx.

Attack Path

1. An attacker compromises the npm package, its publisher account, its release pipeline, or a transitive dependency.
2. The attacker publishes a malicious release under the package name referenced by the documentation.
3. A user follows the documented command without specifying a known-safe version.
4. npx downloads the mutable package release and executes package lifecycle or runtime code.
5. The malicious code runs with the user's local privileges.
6. It may access files available to the user, modify local configuration, or target SurfAgent and the persistent Chrome profile.

Impact Assessment

Successful exploitation can provide arbitrary local code execution with the privileges of the user who runs the installation command. The resulting scope ma ...[truncated 568 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every npm package to a specific, reviewed version rather than relying on an implicit latest release or @latest.
• Replace the commands with versioned forms such as npx -y surfagent-mcp@X.Y.Z, after validating the selected version.
• Pin the ClawHub CLI to an approved version instead of using clawhub@latest.
• Publish and verify expected package integrity hashes where the installation workflow supports them.
• Require npm provenance and publisher verification for released packages.
• Review and lock transitive dependencies in the upstream MCP project.
• Document the approved package publisher, version, release URL, and expected integrity metadata.
• Recommend installation and execution from a restricted, non-administrator account.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Required Desktop Component Is Installed Without Artifact Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14, SKILL.md:31, README.md:45, and README.md:61
Vulnerability Type: Unverified third-party binary distribution
Risk Level: Medium

Vulnerable Code

SKILL.md:14:

yaml

help: "Install SurfAgent from https://surfagent.app — the daemon runs on localhost:7201 by default"

SKILL.md:31:

markdown

1. **SurfAgent installed and running** — download from [surfagent.app](https://surfagent.app)

README.md:45:

markdown

1. **SurfAgent** installed and running — [surfagent.app](https://surfagent.app)

README.md:61:

markdown

- [SurfAgent](https://surfagent.app) — Download

Technical Analysis

The skill requires users to install a desktop application obtained from a general download website. The audited files do not pin an application version, provide an expected cryptographic checksum, identify a signed release artifact, or describe how to verify the Windows publisher signature.

Consequently, the repository does not establish which executable a user will receive. The effective trusted component can change after the skill is reviewed. A compromise of the website, download infrastructure, release pipeline, or signing process could substitute a malicious installer.

This risk is particularly significant because the application is intended to control a real, persistent Chrome profile and expose local browser-automation APIs.

Attack Path

1. An attacker compromises the SurfAgent website, download infrastructure, DNS path, release pipeline, or distribution account.
2. The legitimate installer is replaced or redirected to a modified executable.
3. A user follows the skill documentation and downloads the application without checking a pinned checksum or verified publisher identity.
4. The user installs and runs the substituted application.
5. The malicious application executes with the user's privileges and ca ...[truncated 960 chars]

Remediation

View remediation

Remediation Suggestions

• Link to a version-specific release artifact instead of only a general download page.
• Publish a SHA-256 checksum for each supported installer and instruct users to verify it before execution.
• Digitally sign the Windows installer and document the exact expected publisher name and certificate verification procedure.
• Publish release metadata through an independently verifiable channel.
• Preserve prior signed releases so users can obtain the exact version reviewed with the skill.
• Document secure upgrade procedures and require verification for every update.
• Where feasible, provide reproducible build information or source-based verification instructions.
• Recommend running the component with the minimum operating-system and browser permissions required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description markets full control of a real, persistent Chrome browser with real cookies, sessions, arbitrary JavaScript execution, crawling, and cookie manipulation, but does not provide clear safety warnings about the sensitivity of these capabilities. This omission increases the risk that users enable the skill without understanding it can access authenticated accounts, exfiltrate data, or perform destructive actions in a real browser context.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

OpenClaw

Copy to your OpenClaw skills directory:

bash

cp SKILL.md ~/clawd/skills/surfagent/SKILL.md

ClawHub

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to execute an unpinned package via npx clawhub@latest install surfagent, which implicitly trusts the current registry state at install time. If the package or a dependency is compromised, users may execute attacker-controlled code during installation with no version stability or integrity guarantee.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README tells users to add the MCP server using npx --args -y surfagent-mcp, which fetches and runs the latest published package without version pinning. Because this skill exposes high-impact browser automation against a persistent Chrome profile with real cookies and sessions, a compromised or malicious update could gain access to authenticated browsing context and sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description mentions persistent Chrome usage, but it does not clearly warn that the skill can act with the user's real cookies, authenticated sessions, and live account access. In this context, omission is dangerous because operators may treat the tool like an isolated browser automation environment when it actually has access equivalent to the user's logged-in browser state.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to install/run an MCP server via npx -y surfagent-mcp without pinning a specific version or integrity source. That creates a supply-chain risk: future malicious or compromised package updates could gain browser-control capabilities over the user's persistent Chrome profile and active sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This section promotes clicking, typing, form filling, cookie manipulation, crawling, and JavaScript execution without a clear warning about destructive, privacy-impacting, or account-impacting effects. Given that the browser is real and persistent, these capabilities could submit transactions, alter settings, expose sensitive page data, or violate site policies if used carelessly or by a compromised downstream agent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

If MCP isn't available, call the daemon directly:

bash

# Navigate
curl -X POST http://localhost:7201/browser/navigate \
  -H 'Content-Type: application/json' \
  -d '{"url": "https://example.com"}'

Static analysis

No suspicious patterns detected.