ClawHub
Back to skill

Security audit

browser-recording

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Playwright browser-recording helper, but recordings can capture anything visible in the browser.

Install this only for intentional Playwright recording workflows. Use demo accounts or sanitized test data, avoid entering secrets or production customer data during recording, and review or delete generated WebM/GIF files before sharing them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list contains broad terms like "browser," "video," and "web," which can cause the skill to be invoked in situations far outside its intended use. In an automated agent environment, over-broad invocation increases the chance that browser automation and recording are performed unexpectedly, which can expose session data, page contents, or user activity without clear user intent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs users to record browser sessions but does not warn that videos may capture sensitive information such as authentication tokens in URLs, personal data displayed in the UI, internal dashboards, or other confidential on-screen content. Because the skill is explicitly designed to create reusable tutorial/demo artifacts, the absence of a warning raises the risk that sensitive material is recorded, stored, or shared unintentionally.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The module explicitly enables Playwright video recording and documents persistent storage paths for browser session videos, but it does not warn that recordings may capture secrets, personal data, session tokens displayed in UI, internal URLs, or customer content. In a browser-automation skill focused on recording demos, this omission is material because users are encouraged to generate and retain artifacts that can later be shared or stored insecurely.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.