T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:44- Finding
Mutable Remote Installer Is Piped Directly into Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
FounderClaw
Security checks for vulnerabilities and agentic risk
Overview
FounderClaw is a disclosed multi-agent/browser automation system, but its installer and local browser-control service expose enough high-impact authority that users should review it carefully before installing.
Install only if you are comfortable with a broad local agent system that modifies OpenClaw configuration, runs a browser daemon, and can use authenticated browser sessions. Prefer cloning and reviewing a pinned commit instead of using curl | bash, avoid importing cookies on shared or untrusted machines, and do not leave the browser daemon running while handling sensitive web accounts.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
browse/src/server.ts:827- Finding
Unauthenticated Health Endpoint Discloses the Browser-Control Bearer Token
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
browse/src/cookie-picker-routes.ts:83- Finding
Cookie Discovery and Import Operations Are Exposed Without Authentication
- Content
View full analysis
({ name: b.name, aliases: b.aliases, })), }, { port }); } // GET /cookie-picker/domains?browser=&profile= — list domains + counts if (pathname === '/cookie-picker/domains' && req.method === 'GET') { const browserName = url.searchParams.get('browser'); if (!browserName) { return errorResponse("Missing 'browser' parameter", 'missing_param', { port }); } const profile = url.searchParams.get('profile') || 'Default'; const result = listDomains(browserName, profile); return jsonResponse({ browser: result.browser, domains: result.domains, }, { port }); } // POST /cookie-picker/import — decrypt + import cookies to Playwright session if (pathname === '/cookie-picker/import' && req.method === 'POST') { let body: any; try { body = await req.json(); } catch { return errorResponse('Invalid JSON body', 'bad_request', { port }); } const { browser, domains, profile } = body; if (!browser) return errorResponse("Missing 'browser' field", 'missing_param', { port }); if (!domains || !Array.isArray(domains) || domains.length === 0) { return error ...[truncated 2088 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
browse/src/server.ts:848- Finding
Browser References and Activity Are Exposed Through Unauthenticated Wildcard-CORS Endpoints
- Content
View full analysis
{ try { controller.enqueue(encoder.encode(`event: activity\ndata: ${JSON.stringify(entry)}\n\n`)); } catch { unsubscribe(); } }); ``` The stream response is sent with permissive CORS: ```ts return new Response(stream, { headers: { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive', 'Access-Control-Allow-Origin': '*', }, }); ``` Activity history is also unauthenticated and configured with wildcard CORS: ```ts if (url.pathname === '/activity/history') { const limit = parseInt(url.searchParams.ge ...[truncated 1876 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
install.sh:59- Finding
Installer Automatically Resolves Unpinned Third-Party Dependency Ranges
- Content
View full analysis
/dev/null 2>&1; then echo "Building browse binary..." cd "$FC_DIR/browse" bun install --silent 2>/dev/null if bun build src/cli.ts --compile --outfile dist/browse 2>/dev/null; then echo " ✅ Browse binary built" ``` The dependencies use compatible-version ranges: ```json "dependencies": { "diff": "^7.0.0", "playwright": "^1.58.2", "puppeteer-core": "^24.40.0" }, "engines": { "bun": ">=1.0.0" }, "devDependencies": { "@anthropic-ai/sdk": "^0.78.0" } ``` No lockfile was present in the audited project tree. ### Technical Analysis The installer automatically runs `bun install`, while the dependency manifest permits later compatible releases through caret ranges. Without a committed and enforced lockfile, two users installing the same audited revision may receive different dependency code. This prevents the audit result from reliably covering the software ultimately compiled and run. It also increases exposure to compromised package releases, registry-account takeover, malicious transitive dependencies, or an unsafe future version that remains semver-compatible. The installer suppresses installation errors with `--silent` and redirects standard error to `/dev/null`, reducing visibility into dependency resolution and lifecycle behavior. ### Attack Path 1. A listed dependency or one of its transitive dependencies publishes a compromised semver-compatible release. 2. A user runs `install.sh`. 3. `bun install` resolves the newly published version because the manifest uses version ranges and no audited lockfile constrains resolution. 4. Package lifecycle behavior may execute during installation, or compromised library code may be incl ...[truncated 448 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (367)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The architecture explicitly supports importing and decrypting browser cookies via macOS Keychain, then loading them into an automated browser context. Even with user approval and in-memory handling, this materially expands access to authenticated web sessions; compromise of the local daemon, token, or agent workflow could enable session hijacking or unauthorized actions using imported cookies.
- Content
md Cookies are the most sensitive data founderclaw handles. The design: 1. **Keychain access requires user approval.** First cookie import per browser triggers a macOS Keychain dialog. The user must click "Allow" or "Always Allow." founderclaw never silently accesses credentials. 2. **Decryption happens in-process.** Cookie values are decrypted in memory (PBKDF2 + AES-128-CBC), loaded into the Playwright context, and never written to disk in plaintext. The cookie picker UI never displays cookie values — only domain names and counts.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### Shell injection prevention The browser registry (Comet, Chrome, Arc, Brave, Edge) is hardcoded. Database paths are constructed from known constants, never from user input. Keychain access uses `Bun.spawn()` with explicit argument arrays, not shell string interpolation. ## The ref system
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 1. Copy .env.example and add your API key cp .env.example .env # Edit .env → set ANTHROPIC_API_KEY=sk-ant-... # 2. Install deps (if you haven't already)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 1. Copy .env.example and add your API key cp .env.example .env # Edit .env → set ANTHROPIC_API_KEY=sk-ant-... # 2. Install deps (if you haven't already) bun install
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 1. Copy .env.example and add your API key cp .env.example .env # Edit .env → set ANTHROPIC_API_KEY=sk-ant-... # 2. Install deps (if you haven't already) bun install
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 1. Copy .env.example and add your API key cp .env.example .env # Edit .env → set ANTHROPIC_API_KEY=sk-ant-... # 2. Install deps (if you haven't already) bun install
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 1. Copy .env.example and add your API key cp .env.example .env # Edit .env → set ANTHROPIC_API_KEY=sk-ant-... # 2. Install deps (if you haven't already) bun install
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 1. Copy .env.example and add your API key cp .env.example .env # Edit .env → set ANTHROPIC_API_KEY=sk-ant-... # 2. Install deps (if you haven't already) bun install
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 1. Copy .env.example and add your API key cp .env.example .env # Edit .env → set ANTHROPIC_API_KEY=sk-ant-... # 2. Install deps (if you haven't already) bun install
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Remove the project-local symlink. Claude Code falls back to
founderclaw/:bash rm .claude/skills/founderclawThe per-skill symlinks (
qa,ship, etc.) still point tofounderclaw/..., so they'll
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
- connect-chrome — real Chrome with Side Panel
- setup-browser-cookies — import cookies for auth testing
- setup-deploy — configure deployment platform
- founderclaw-upgrade — self-update
- install-founderclaw — install/repair founderclaw
text
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
- connect-chrome — real Chrome with Side Panel
- setup-browser-cookies — import cookies for auth testing
- setup-deploy — configure deployment platform
- founderclaw-upgrade — self-update
- install-founderclaw — install/repair founderclaw
text
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Piping downloaded content directly into bash compounds risk by immediately chaining network retrieval to code execution with no review boundary. In the context of this skill, the installer is expected to create files, modify OpenClaw configuration, add agents, and restart the gateway, so misuse or compromise could rapidly alter the local agent environment.
- Content
Terminal
bash curl -fsSL https://raw.githubusercontent.com/ashish797/FounderClaw/main/install.sh | bashThen say "install founderclaw" in chat to complete the multi-agent config.
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
An uninstaller that deletes repository files, removes symlinks, and edits OpenClaw configuration is a destructive capability that should be clearly separated from ordinary skill behavior. If triggered unexpectedly or without confirmation, it can remove local assets and corrupt user configuration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
An uninstaller that deletes repository files, removes symlinks, and edits OpenClaw configuration is a destructive capability that should be clearly separated from ordinary skill behavior. If triggered unexpectedly or without confirmation, it can remove local assets and corrupt user configuration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
An uninstaller that deletes repository files, removes symlinks, and edits OpenClaw configuration is a destructive capability that should be clearly separated from ordinary skill behavior. If triggered unexpectedly or without confirmation, it can remove local assets and corrupt user configuration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
An uninstaller that deletes repository files, removes symlinks, and edits OpenClaw configuration is a destructive capability that should be clearly separated from ordinary skill behavior. If triggered unexpectedly or without confirmation, it can remove local assets and corrupt user configuration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
An uninstaller that deletes repository files, removes symlinks, and edits OpenClaw configuration is a destructive capability that should be clearly separated from ordinary skill behavior. If triggered unexpectedly or without confirmation, it can remove local assets and corrupt user configuration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
An uninstaller that deletes repository files, removes symlinks, and edits OpenClaw configuration is a destructive capability that should be clearly separated from ordinary skill behavior. If triggered unexpectedly or without confirmation, it can remove local assets and corrupt user configuration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
An uninstaller that deletes repository files, removes symlinks, and edits OpenClaw configuration is a destructive capability that should be clearly separated from ordinary skill behavior. If triggered unexpectedly or without confirmation, it can remove local assets and corrupt user configuration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
An uninstaller that deletes repository files, removes symlinks, and edits OpenClaw configuration is a destructive capability that should be clearly separated from ordinary skill behavior. If triggered unexpectedly or without confirmation, it can remove local assets and corrupt user configuration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
An uninstaller that deletes repository files, removes symlinks, and edits OpenClaw configuration is a destructive capability that should be clearly separated from ordinary skill behavior. If triggered unexpectedly or without confirmation, it can remove local assets and corrupt user configuration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
An uninstaller that deletes repository files, removes symlinks, and edits OpenClaw configuration is a destructive capability that should be clearly separated from ordinary skill behavior. If triggered unexpectedly or without confirmation, it can remove local assets and corrupt user configuration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
An uninstaller that deletes repository files, removes symlinks, and edits OpenClaw configuration is a destructive capability that should be clearly separated from ordinary skill behavior. If triggered unexpectedly or without confirmation, it can remove local assets and corrupt user configuration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
An uninstaller that deletes repository files, removes symlinks, and edits OpenClaw configuration is a destructive capability that should be clearly separated from ordinary skill behavior. If triggered unexpectedly or without confirmation, it can remove local assets and corrupt user configuration.
- Content