ClawHub
Back to skill

Security audit

live-web-page-browser

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed remote web browser integration, but it gives broad URL crawling and account session controls to a third-party service with weak local scoping and mutable remote instructions.

Install only if you are comfortable sending requested URLs, rendered content, screenshots, and crawl targets to AgentPMT. Avoid private internal sites, authenticated pages, signed URLs, secrets in query strings, and regulated data unless your organization has approved this service. Prefer pinned setup commands, review any live instructions before following them, and be careful with account-wide browser session listing or termination.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:126
Finding

Unpinned Third-Party Installation Commands Create a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 126-127
Vulnerability Type: Unpinned third-party dependencies and installation sources
Risk Level: Medium

Vulnerable Code:

bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup

Technical Analysis

The setup instructions execute an npm-distributed command and install skills from a moving repository reference without pinning a package version, repository commit, integrity digest, or trusted signature. The effective content installed or executed when a user follows these instructions can therefore differ from the content available during this audit.

This does not establish that the current dependencies are malicious. However, it creates a supply-chain trust boundary in which compromise of the npm package, source repository, publisher account, or distribution infrastructure could introduce unreviewed behavior.

Attack Path

  1. An attacker compromises the npm package, upstream repository, or a publisher account used by the installation process.
  2. The attacker publishes or references a modified package or Skill containing unintended behavior.
  3. A user follows the documented unpinned npx skills add instructions.
  4. The installation process retrieves the attacker-controlled current version rather than an audited immutable version.
  5. Malicious installation logic or Skill content executes or is installed with the permissions available to the invoking user.

Impact Assessment

The exact impact depends on the behavior and privileges of the external installer and installed Skills, which are not included in this project. If the retrieved component executes locally, it may obtain the invoking user's filesystem, environment, network, and process privileges. It could also alter Agent behavior through subsequently loaded Skill instructions. No such m ...[truncated 150 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the npm package or command-line utility to a reviewed version.
  • Pin the AgentPMT repository to an immutable commit hash or signed release tag.
  • Publish cryptographic checksums or signatures and verify them before installation.
  • Avoid executing latest-version package content directly through npx.
  • Vendor the required setup instructions or dependencies where practical so their contents can be audited with this Skill.
  • Document the permissions and local effects of the installer before asking users to run it.
  • Require a separate review whenever the pinned dependency version or repository commit changes.

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:68
Finding

Mutable Remote Instructions Are Granted Precedence Over the Audited Skill

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 68-72
Vulnerability Type: Remote instruction trust and instruction-precedence weakness
Risk Level: Medium

Vulnerable Code:

text
- Exact schema: call `agentpmt-tool-search-and-execution` with `action: "get_schema"`, and `tool_id: "live-web-page-browser"`.
- Detailed examples: call `agentpmt-tool-search-and-execution` with `action: "get_instructions"` and `tool_id: "live-web-page-browser"`, or call this product with `action: "get_instructions"` when the product tool is already selected.
- Treat returned live schema and instructions as more specific than this generated summary.

Technical Analysis

The Skill directs the Agent to retrieve instructions from an external service and treat the returned content as more specific than the locally audited summary. The remote response is mutable and is not constrained by a pinned digest, local action allowlist, or explicit rule that returned prose must be treated only as untrusted data.

No currently malicious remote response was available in the audited project, and the text does not explicitly instruct the Agent to bypass system safety controls. Nevertheless, this precedence rule creates an instruction-control channel outside the reviewed package. A compromised service, account, or upstream configuration could cause the Agent's effective behavior to diverge from the audited Skill.

Attack Path

  1. The Agent encounters an unclear parameter or begins a production integration.
  2. Following the Skill, it invokes the remote get_instructions action.
  3. The external endpoint returns modified instructions due to compromise, malicious administration, or an unsafe upstream update.
  4. The Agent treats the remote instructions as more specific than the local Skill.
  5. The Agent follows newly introduced operations, destinations, or data requests that were not present in the audited package.

Impact Asses

...[truncated 472 chars]

Remediation
View remediation

Remediation Suggestions

  • Treat all remotely returned schemas, examples, and instructions as untrusted data rather than authoritative Agent instructions.
  • Remove the rule granting remote content precedence over the audited local Skill.
  • Pin supported action names, parameter types, and security constraints locally.
  • Validate remote responses against a strict local schema and action allowlist.
  • Ignore remote directives that request credentials, new tools, additional destinations, or broader permissions.
  • Require explicit user approval before following any remote instruction that changes the action, data scope, endpoint, cost, or security posture.
  • Authenticate the remote endpoint and use signed, versioned schema documents where dynamic lookup is unavoidable.

T09 · Insecure Skill Coding Practices

Warning
Location
schema.md:477
Finding

Arbitrary URL Forwarding Lacks Restrictions for Sensitive and Internal Targets

Content
View full analysis

Vulnerability Details

File Location: schema.md, lines 477-541
Vulnerability Type: Insufficient URL validation and remote browsing restrictions
Risk Level: Medium

Vulnerable Code:

json
{
  "depth": {
    "description": "How many links deep to crawl",
    "maximum": 9007199254740991,
    "minimum": 1,
    "type": "integer"
  },
  "limit": {
    "description": "Maximum number of pages to crawl",
    "maximum": 9007199254740991,
    "minimum": 1,
    "type": "integer"
  },
  "render": {
    "default": true,
    "description": "Whether to render pages with a browser (vs. fetching raw HTML)",
    "type": "boolean"
  },
  "url": {
    "format": "uri",
    "type": "string"
  }
}

The same URI-only validation pattern is also used by the individual HTML, JSON, links, Markdown, PDF, screenshot, snapshot, and element-scraping actions.

Technical Analysis

Sending a URL to a remote browser is necessary for the declared live-webpage functionality. However, the schema only requires the input to satisfy a generic URI format. It does not specify an https scheme allowlist, reject embedded credentials, remove sensitive query parameters, or prohibit loopback, link-local, private-network, local-file, and cloud metadata destinations.

URLs may contain signed query strings, reset tokens, session-bearing parameters, confidential paths, or internal hostnames. Forwarding such a URL discloses it to the AgentPMT-hosted service. If the remote browser can access restricted network ranges, crafted targets may also create an SSRF-like browsing path. The project does not establish whether the remote service independently blocks these destinations, so actual reachability cannot be confirmed from the audited files.

Crawl limits are also effectively unconstrained, with a declared maximum of 9007199254740991. This is substantially broader than the minimum privilege and resource scope needed fo ...[truncated 1398 chars]

Remediation
View remediation

Remediation Suggestions

  • Allow only https destinations by default.
  • Reject URLs containing embedded usernames or passwords.
  • Resolve hostnames and block loopback, link-local, private, reserved, multicast, and cloud metadata address ranges, including after redirects and DNS resolution changes.
  • Reject local-file and non-web schemes.
  • Detect and redact common secret-bearing query parameters before transmitting URLs.
  • Require explicit user confirmation for authenticated, signed, private, or non-public URLs.
  • Apply strict local maximums for crawl depth, page count, response size, execution time, and redirect count.
  • Default to single-page retrieval and enable crawling or rendering only when explicitly required.
  • Document the remote service's URL retention, logging, access controls, subprocessors, and network isolation.
  • Add server-side destination validation rather than relying solely on Agent instructions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description emphasizes live browsing capability but does not prominently warn that user-supplied URLs, page targets, and extracted content are sent to a remote hosted service. In a tool whose core behavior is external fetching and scraping, missing disclosure meaningfully increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation keywords include very broad, common phrases like research, fact-checking, and monitoring. That increases the chance the skill is invoked in contexts where users did not intend to send URLs or browsing targets to a remote web-fetching service, causing inadvertent external data transmission or unexpected tool use.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill recommends installing dependencies via npx skills add ... without pinning a specific version or commit. That creates a supply-chain risk: future upstream package changes, compromise of the package, or malicious dependency updates could alter what gets installed and executed on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This line repeats an unpinned npx skills add ... installation path, exposing users to remote code or content changes outside their control. In skill documentation, install snippets are highly actionable, so leaving them unpinned materially increases supply-chain exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The documented install script uses npx without version pinning, which can fetch the latest package state at runtime. If the upstream package or one of its dependencies is compromised, users following the skill could execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

A second unpinned npx command appears in the bundled install script, carrying the same supply-chain risk as other mutable install references. Because this is copy-pasteable setup content, the likelihood of unsafe execution is non-trivial.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This reference again directs users to an unpinned npx skills add installation flow. Repeated mutable install guidance amplifies the chance that users will execute a compromised or unexpected package version.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

Another unpinned package execution path is documented here, preserving a supply-chain attack surface. Because the skill explicitly tells users to install prerequisite skills, this is operationally relevant rather than theoretical.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The skill routes requests to external AgentPMT endpoints, meaning URLs, crawl parameters, page content, and possibly screenshots are transmitted off-platform. External transmission is expected for this product, but it is still security-relevant because misuse could expose sensitive browsing targets or retrieved content to a third-party service.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/live-web-page-browser
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The REST invoke endpoint confirms that tool operations are performed through an external hosted service. In this skill's context, that is core functionality rather than covert exfiltration, but it still creates confidentiality and compliance risk if agents send private URLs, internal web apps, or sensitive page contents.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/live-web-page-browser
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill exposes actions that send user-supplied URLs and page content to an external browsing/crawling service, but the schema does not warn about this data flow. That can cause users or agents to unintentionally transmit sensitive internal URLs, authenticated pages, or proprietary content to a third-party system, creating confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The schema documents account-wide session enumeration and session termination capabilities without warning that these operations can affect other active browser sessions for the same account. An agent or user could unintentionally disrupt unrelated workflows, terminate another process's live session, or expose metadata about concurrent activity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.