ClawHub
Back to skill

Security audit

WSL Chrome CDP

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent browser automation for WSL2, but it exposes powerful Chrome remote-debugging access with insufficient scoping and warnings.

Review this carefully before installing. Use only a dedicated Chrome debug profile, avoid logging sensitive accounts into it, do not open port 9222 to broad networks, and remove the unnecessary OpenClaw config-write permission unless the package clearly documents and requires it.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
docs/troubleshooting.md:126
Finding

Unauthenticated Chrome DevTools Protocol Exposed Through an Unrestricted Firewall Rule

Content
View full analysis

Vulnerability Details

File Location: docs/troubleshooting.md:126-140, with related browser startup behavior at enable-browser.sh:83-84
Vulnerability Type: Unrestricted network exposure of an unauthenticated browser-control interface
Risk Level: High

Vulnerable Code

docs/troubleshooting.md:126-140:

markdown
## ❌ 问题 5：防火墙阻止

**症状：**

```bash
# WSL 可以 ping 通 Windows，但 CDP 端口不通
curl http://$WINDOWS_IP:9222/json/version
# Connection refused

解决：

在 Windows PowerShell（管理员）中执行：

powershell
# 添加入站规则
New-NetFirewallRule -DisplayName "Chrome CDP" -Direction Inbound -LocalPort 9222 -Protocol TCP -Action Allow
text

Related Chrome launch configuration in `enable-browser.sh:83-84`:

```bash
ps_command='Start-Process "C:\Program Files\Google\Chrome\Application\chrome.exe" -ArgumentList "--remote-debugging-port=9222","--user-data-dir=C:\Users\$env:USERNAME\AppData\Local\Google\Chrome\Debug","--no-first-run"'
$POWERShell -Command "$ps_command"

Technical Analysis

The script starts Chrome with the Chrome DevTools Protocol enabled on TCP port 9222. CDP is a privileged browser-control API and does not provide an authentication mechanism of its own.

The troubleshooting guide instructs administrators to create an inbound Windows Firewall rule that permits TCP connections to port 9222. The rule does not specify RemoteAddress, InterfaceAlias, or Profile, so it is not restricted to the WSL virtual network, localhost, or another trusted source.

If Chrome's debugging endpoint becomes reachable through a non-loopback interface, local forwarding, or the Windows networking configuration, any host able to connect to port 9222 can query CDP discovery endpoints such as /json/version and /json/list. Those endpoints can disclose WebSocket debugger URLs through which the browser can be controlled.

Although the script uses a dedicated debugging profile rather than the ...[truncated 1759 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not create a firewall rule allowing arbitrary remote addresses to reach CDP.

  2. Keep the CDP listener bound to loopback whenever the WSL configuration supports loopback forwarding.

  3. If a firewall exception is unavoidable, restrict it to the specific WSL virtual-network address range or exact source address:

    powershell
    New-NetFirewallRule `
  -DisplayName "Chrome CDP from WSL only" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 9222 `
  -RemoteAddress "<trusted-WSL-address-or-subnet>" `
  -Profile Private `
  -Action Allow

  4. Restrict the rule to the appropriate interface and firewall profile where possible.

  5. Continue using a dedicated, empty Chrome profile and avoid authenticating sensitive accounts in it.

  6. Remove the firewall rule when browser automation is no longer required.

  7. Add a prominent warning that CDP is unauthenticated and must not be exposed to untrusted networks.

  8. Consider a protected local forwarding mechanism instead of directly exposing port 9222.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
clawhub.yaml:30
Finding

Manifest Requests Unnecessary Configuration-Write Permission and Invalid Execution Permissions

Content
View full analysis

Vulnerability Details

File Location: clawhub.yaml:30-33
Vulnerability Type: Excessive and inconsistent Skill permissions
Risk Level: Medium

Vulnerable Code

yaml
permissions:
  - exec:scripts/enable-browser.sh
  - exec:scripts/start-chrome-debug.bat
  - write:~/.openclaw/openclaw.json

Technical Analysis

The manifest requests write access to ~/.openclaw/openclaw.json, but the audited entrypoint does not write to that file. The declared functionality only detects and starts Chrome and tests CDP connectivity. Granting write access to the OpenClaw configuration therefore exceeds the entrypoint's demonstrated requirements and violates the principle of least privilege.

Write access to the main OpenClaw configuration is security-sensitive because configuration changes may alter browser profiles, tool endpoints, or other agent behavior, depending on the settings supported by the installed OpenClaw version.

The two execution permissions are also inconsistent with the package contents:

  • The actual entrypoint is enable-browser.sh at the project root, not scripts/enable-browser.sh.
  • scripts/start-chrome-debug.bat is not present in the audited project.

These inconsistencies can cause installation failures or make permission review misleading. They also make it difficult for users and automated policy systems to determine which executable content is genuinely required.

Attack Path

  1. A user or installer reviews the manifest and grants all requested permissions.
  2. The Skill receives write access to ~/.openclaw/openclaw.json, despite the current entrypoint not needing that capability.
  3. If Skill content is subsequently altered, substituted, or extended within the granted permission boundary, it can modify the OpenClaw configuration without requesting a new capability.
  4. A malicious modification could redirect a browser profile to an attacker-controlled endpoint or change othe ...[truncated 926 chars]
Remediation
View remediation

Remediation Suggestions

Apply least privilege and align the manifest with the actual package:

yaml
permissions:
  - exec:enable-browser.sh

Specifically:

  1. Remove write:~/.openclaw/openclaw.json unless configuration modification is implemented and essential.
  2. If configuration changes become necessary, request access only at the point of use, document every field being changed, preserve the existing configuration, and require explicit user approval.
  3. Replace exec:scripts/enable-browser.sh with exec:enable-browser.sh.
  4. Remove exec:scripts/start-chrome-debug.bat, or add and independently audit the referenced file if it is genuinely required.
  5. Add package validation that rejects permissions referring to nonexistent files.
  6. Ensure documentation, manifest permissions, and the declared entrypoint all reference the same paths.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · PUBLISH.md (reported line 32)May include surrounding context.

md
2. 仓库名称：`wsl-chrome-cdp`
3. 描述：`WSL2 自动访问 Windows Chrome 浏览器（CDP 远程调试）`
4. 可见性：Public（公开）
5. 点击 "Create repository"

**方法 B：使用 GitHub CLI（如果安装了 gh）**

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · PUBLISH.md (reported line 32)May include surrounding context.

md
2. 仓库名称:`wsl-chrome-cdp`
3. 描述:`WSL2 自动访问 Windows Chrome 浏览器(CDP 远程调试)`
4. 可见性:Public(公开)
5. 点击 "Create repository"

**方法 B:使用 GitHub CLI(如果安装了 gh)**

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger example '打开百度' is extremely broad and indistinguishable from ordinary browser-use requests, which can cause this skill to activate in situations the user may not intend. Because the skill enables automated control of an existing Windows Chrome session via CDP, accidental invocation can affect live browsing state, authenticated sessions, and page interactions without a clear boundary or warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README presents the skill as simple and automatic but does not warn users that automated browser actions may operate on their existing Chrome profile, authenticated sessions, or sensitive page data. In this context, missing warnings increase the chance that users unknowingly permit navigation, clicking, form filling, screenshots, or extraction on real accounts and open tabs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description emphasizes full automation but does not warn users that the skill may automatically launch Chrome with the DevTools remote debugging interface enabled. Exposing Chrome in remote debugging mode can grant powerful browser control to local or network-reachable processes, increasing the risk of unintended access to browsing data, authenticated sessions, and browser actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example triggers are extremely generic phrases such as opening a site or taking a screenshot, which are likely to overlap with normal user requests. In an agent environment, this can cause the skill to activate unexpectedly and perform side effects like launching Chrome and enabling remote debugging when the user did not explicitly intend to use this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest requests permission to execute shell and batch scripts and to write to a persistent OpenClaw configuration file, but the user-facing install and usage text only presents the skill as successfully installed and ready to use. Because these capabilities can modify system behavior, launch software, and persist configuration changes, the lack of transparent warning reduces informed consent and makes misuse or unexpected side effects more dangerous.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The post-install instructions advertise a very broad natural-language trigger phrase ('打开百度' / 'open Baidu') without describing activation boundaries, required confirmation, or what actions the skill may perform. In an automation skill that launches and controls Chrome via CDP, vague triggers increase the chance of unintended browser actions or invocation in contexts the user did not clearly consent to.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The troubleshooting guide instructs users to create a Windows firewall rule opening inbound TCP port 9222 for Chrome CDP, but it does not warn that exposing CDP can grant powerful browser control to other reachable hosts. In this skill’s context, CDP is a remote debugging interface that can expose browsing data and enable arbitrary browser actions, so omitting scope restrictions and security guidance materially increases risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script automatically launches Chrome with --remote-debugging-port=9222 and a dedicated user-data-dir, exposing a Chrome DevTools Protocol endpoint without explicit user consent or a clear warning about the security implications. CDP can enable powerful browser control; if the endpoint is reachable beyond the intended local scope or by other local processes, it may allow inspection, automation, and access to browser data within that debug profile.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file presents all user-facing instructions in Chinese and does not indicate that other languages are available or that Chinese is required for a region-specific purpose. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

整份技能文档以中文呈现，未说明这是面向特定中文用户群体的区域化文档，也未提供其他语言选项或用户选择机制。按照语言/区域政策要求，若非明确限定场景，强制单一语言可能构成自然语言策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script's human-facing title, purpose, author line, and runtime status/output messages are written in Chinese throughout, which imposes a specific language on users. There is no opt-in, fallback language, or documentation that this skill is intentionally limited to Chinese-speaking users or a Chinese-only environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.