Browser VM Setup

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.1

Overview

This skill is a transparent VM browser-agent setup guide with real operational risks, but the risky steps are disclosed and aligned with its purpose.

Install only on a VM you own or control. Review every sudo and npx command before running it, prefer pinned dependencies and verified package sources, keep the dashboard bound to loopback behind SSH or mesh access, avoid disabling the Chromium sandbox unless the VM is isolated and disposable, and never use the automation to bypass site defenses or access accounts you are not authorized to use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:94

Finding

Unpinned Playwright Package Is Retrieved and Executed

Content

View full analysis

Remediation

View remediation

``` 2. Commit `package.json` and the generated lockfile, and provision with: ```bash npm ci npx playwright install chromium ``` 3. Use registry integrity metadata and verify that the lockfile resolves only to the expected registry. 4. Separate browser download from operating-system dependency installation. Review and install required OS packages through the distribution package manager using a narrowly scoped privileged step. 5. Do not run `npx`, npm lifecycle operations, or browser installation as root. 6. Consider an internally mirrored or preapproved package source and a prebuilt VM/container image for repeatable deployments. 7. Add dependency scanning and lockfile review to the deployment workflow before version updates are accepted. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:82

Finding

Chromium Sandbox Is Disabled in Recommended VM Configuration

Content

View full analysis

", "attachOnly": true, "noSandbox": true } } } } ``` ### Technical Analysis Chromium's sandbox isolates renderer and related browser processes from the host account and restricts the resources available after exploitation of a browser vulnerability. Setting `noSandbox: true` or passing `--no-sandbox` removes an important defense-in-depth boundary. A disposable VM reduces long-term persistence and simplifies recovery, but it does not protect data available during the active run. The Skill explicitly anticipates persistent cookies, logged-in sessions, screenshots, logs, and OpenClaw configuration on the same machine. A compromised browser process may therefore reach data and services accessible to the browser's operating-system account. The configuration is presented as a workaround for restricted user namespaces. Although the documentation acknowledges the tradeoff, it recommends sandbox-disabled launch arguments as the reference VM configuration rather than limiting them to an exceptional, isolated fallback. ### Attack Path 1. The operator configures the browser with `noSandbox: true` or launches it with `--no-s ...[truncated 1600 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (14)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

On Linux with no `DISPLAY`, the browser tool **falls back to headless automatically** — no error, no warning. Check `echo $DISPLAY` before blaming the config.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md

rst. Newer major? NodeSource ships a setup script: download and read
  # it before running. Piping a remote script into sudo bash is the operator's call.
  sudo apt-get install -y nodejs
fi
node -v          # Output: v22.x.x

# Retention — screenshots and logs may hold personal data
mkdir -p ~/.openclaw/screenshots ~/.openclaw/logs   # find errors on a missing dir; cron then mails you nightly
( crontab -l 2>/dev/null | grep -q openclaw-purge ) || \
  ( crontab -l 2>/dev/null; \
    echo '17 4 * * * find "$HOME/.openclaw/screenshots" "$HOME/.openclaw/logs" -type f -mtime +7 -delete >/dev/null 2>&1  # openclaw-purge' \
  ) | crontab -

# Verify it landed, then prove it deletes: plant a file past the window, run the finder by hand
crontab -l | grep -c openclaw-purge          # Output: 1
touch -d '8 days ago' ~/.openclaw/logs/purge-probe.log
find "$HOME/.openclaw/logs" -type f -mtime +7 -delete
ls ~/.openclaw/logs/purge-probe.log
# Output: ls: cannot access '.../purge-probe.log': No such

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

| Item | What this skill assumes | Default |
|---|---|---|
| Machine access | root/sudo on a Linux VM you own or rent | none — you provision it |
| Runtime | Node.js 22.19+ (24 recommended) | none — you install it (§8) |
| Gateway | the agent gateway is a **prerequisite** you install first, from its vendor's own docs | not installed by this skill |
| LLM key | one provider key, bring-your-own | none |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md

| Item | What this skill assumes | Default |
|---|---|---|
| Machine access | root/sudo on a Linux VM you own or rent | none — you provision it |
| Runtime | Node.js 22.19+ (24 recommended) | none — you install it (§8) |
| Gateway | the agent gateway is a **prerequisite** you install first, from its vendor's own docs | not installed by this skill |
| LLM key | one provider key, bring-your-own | none |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

On Linux with no DISPLAY, the browser tool falls back to headless automatically — no error, no warning. Check echo $DISPLAY before blaming the config.

bash

sudo apt-get install -y xvfb x11vnc
Xvfb :99 -screen 0 1920x1080x24 &   # `&` dies at logout — systemd unit or xvfb-run for a daemon
export DISPLAY=:99

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

On Linux with no DISPLAY, the browser tool falls back to headless automatically — no error, no warning. Check echo $DISPLAY before blaming the config.

bash

sudo apt-get install -y xvfb x11vnc
Xvfb :99 -screen 0 1920x1080x24 &   # `&` dies at logout — systemd unit or xvfb-run for a daemon
export DISPLAY=:99

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The skill downloads a Chrome .deb with wget and installs it via sudo apt-get install -y ./google-chrome-stable_current_amd64.deb without any integrity verification step. If the download source, transport path, or artifact were tampered with, this would result in privileged installation of attacker-controlled code.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

bash

# Chrome from .deb — never snap
wget -q https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
sudo apt-get install -y ./google-chrome-stable_current_amd64.deb
google-chrome --version
# Output: Google Chrome 1XX.0.XXXX.XX

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs use of npx playwright install --with-deps chromium without pinning a specific Playwright version. That makes the provisioning path depend on whatever version resolves at execution time, creating supply-chain and reproducibility risk if an upstream package version changes or is compromised.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

md

node -v          # Output: v22.x.x

# Retention — screenshots and logs may hold personal data
mkdir -p ~/.openclaw/screenshots ~/.openclaw/logs   # find errors on a missing dir; cron then mails you nightly
( crontab -l 2>/dev/null | grep -q openclaw-purge ) || \
  ( crontab -l 2>/dev/null; \
    echo '17 4 * * * find "$HOME/.openclaw/screenshots" "$HOME/.openclaw/logs" -type f -mtime +7 -delete >/dev/null 2>&1  # openclaw-purge' \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md

# Retention — screenshots and logs may hold personal data
mkdir -p ~/.openclaw/screenshots ~/.openclaw/logs   # find errors on a missing dir; cron then mails you nightly
( crontab -l 2>/dev/null | grep -q openclaw-purge ) || \
  ( crontab -l 2>/dev/null; \
    echo '17 4 * * * find "$HOME/.openclaw/screenshots" "$HOME/.openclaw/logs" -type f -mtime +7 -delete >/dev/null 2>&1  # openclaw-purge' \
  ) | crontab -

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md

# Retention — screenshots and logs may hold personal data
mkdir -p ~/.openclaw/screenshots ~/.openclaw/logs   # find errors on a missing dir; cron then mails you nightly
( crontab -l 2>/dev/null | grep -q openclaw-purge ) || \
  ( crontab -l 2>/dev/null; \
    echo '17 4 * * * find "$HOME/.openclaw/screenshots" "$HOME/.openclaw/logs" -type f -mtime +7 -delete >/dev/null 2>&1  # openclaw-purge' \
  ) | crontab -

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md

# Retention — screenshots and logs may hold personal data
mkdir -p ~/.openclaw/screenshots ~/.openclaw/logs   # find errors on a missing dir; cron then mails you nightly
( crontab -l 2>/dev/null | grep -q openclaw-purge ) || \
  ( crontab -l 2>/dev/null; \
    echo '17 4 * * * find "$HOME/.openclaw/screenshots" "$HOME/.openclaw/logs" -type f -mtime +7 -delete >/dev/null 2>&1  # openclaw-purge' \
  ) | crontab -

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

md

# Retention — screenshots and logs may hold personal data
mkdir -p ~/.openclaw/screenshots ~/.openclaw/logs   # find errors on a missing dir; cron then mails you nightly
( crontab -l 2>/dev/null | grep -q openclaw-purge ) || \
  ( crontab -l 2>/dev/null; \
    echo '17 4 * * * find "$HOME/.openclaw/screenshots" "$HOME/.openclaw/logs" -type f -mtime +7 -delete >/dev/null 2>&1  # openclaw-purge' \
  ) | crontab -

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The example output advertises sandbox=off, normalizing a disabled browser sandbox as a deployment state. Disabling Chromium's sandbox significantly weakens containment, so a renderer or browser exploit can more readily escape into the host context, especially on a VM handling untrusted web content.

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

text

VM: eu-central · 4/16 · rebuilt-from: provision.sh@a1b2c3d
BROWSER: chrome-deb headed:99 · shm=1g · sandbox=off
EGRESS: direct · geo=FR · non-direct-approved-by=n-a
ACCESS: dashboard=127.0.0.1:18789 via ssh-tunnel · public=no
DATA: persists=[cookies,screenshots,logs] · retention=7 days · purge-cron=verified · webhooks=none

Static analysis

No suspicious patterns detected.