T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/launch_browser.py:23- Finding
Chrome Sandbox Disabled While Loading User-Controlled URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
Selenium Browser
Security checks for vulnerabilities and agentic risk
Overview
This skill does launch a Selenium Chrome browser, but its packaged script and documentation disagree in ways that could leave browsers running and expose users to arbitrary web content with weakened browser isolation.
Install only after reviewing and tightening it: use explicit invocation, restrict or confirm URLs, remove --no-sandbox unless there is equivalent container isolation, pin and verify dependencies, and make the shipped script match the documented screenshot-and-exit workflow.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
references/setup.md:14- Finding
Unpinned Python Dependency and Unverified ChromeDriver Installation
- Content
View full analysis
- Remediation
View remediation
other
Note
- Location
scripts/launch_browser.py:43- Finding
Unbounded Browser Lifetime and Misleading Documented Behavior
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The core browser-launch behavior matches part of the description: it starts Selenium-controlled Chrome, opens a URL, and supports headless mode and optional proxy. However, the declared description specifically says the skill takes a screenshot and reports progress, and the provided code does neither. Instead, it opens the page and waits indefinitely until termination. That is a material description-to-behavior mismatch because expected user-visible capabilities are missing and the operational flow is different from a screenshot task.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Triggering on generic words like
open,browser, orscreenshotis overly broad and can cause unintended activation on unrelated conversations. Because activation leads to launching a browser and visiting a supplied URL, this raises the risk of untrusted navigation, internal resource access, or disk writes without clear user intent.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill can read environment variables to discover executable paths, yet it declares no explicit tool scope or permissions boundary. In an agent ecosystem, missing scope declarations weakens reviewability and can allow a skill with code execution capabilities to access more host context than operators expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill lacks a clear warning that it will visit arbitrary URLs and save screenshots locally, both of which carry security and privacy risk. In context, a Selenium-driven browser can reach attacker-controlled pages, trigger requests to internal services, and capture sensitive content into files that may persist on disk.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation says screenshots are saved to
/home/main/clawd/diffusion_pdfs/, but the code actually writes to$HOME/screenshot.pngor/tmp/screenshot.png. This discrepancy can mislead operators about where potentially sensitive screenshots are stored, causing accidental exposure, improper retention, or failure to monitor the real output location.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The example output reports a fixed path under
/home/main/clawd/diffusion_pdfs/, but the script returns a different runtime-derived path. Misreporting artifact locations undermines auditability and can lead users or downstream automation to fetch the wrong file while the real screenshot remains elsewhere on disk.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file contains commands that install software packages and place executables into privileged system paths, which can affect system integrity and require elevated privileges. The guide does not include any warning or disclosure about these side effects, rollback considerations, or the need to review commands before running them.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Install Google Chrome
text # Ubuntu/Debian sudo apt-get update sudo apt-get install -y google-chrome-stable # Fedora
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Install Google Chrome
text # Ubuntu/Debian sudo apt-get update sudo apt-get install -y google-chrome-stable # Fedora
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Install Google Chrome
text # Ubuntu/Debian sudo apt-get update sudo apt-get install -y google-chrome-stable # Fedora
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest says the skill will open a URL, take a screenshot, and report progress. In this file, the code only starts Chrome, navigates to the URL, then idles indefinitely until interrupted; there is no screenshot logic and no progress reporting output or callbacks.
- Content
Static analysis
No suspicious patterns detected.