ClawHub
Back to skill

Security audit

Agent Browser.Skip

Security checks across malware telemetry and agentic risk

Overview

This is a documented browser automation skill with powerful session and data-handling features that fit its purpose but require careful use on sensitive sites.

Install only if you trust the external agent-browser CLI package/source. Use an isolated browser profile for automation, avoid running it against sensitive logged-in accounts unless necessary, review important actions before form submissions or account changes, and store screenshots, recordings, traces, cookies, and auth-state files carefully.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest description presents the skill as limited to structured navigation, clicking, typing, and snapshots, but the documented interface also permits arbitrary JavaScript execution, network interception, cookie/storage manipulation, credential injection, and session import/export. This mismatch can cause downstream agents or policy layers to grant broader capabilities than they realize, increasing the risk of misuse or unsafe automation.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The documented `agent-browser eval` command enables arbitrary JavaScript execution in the browser context, which goes beyond strictly structured browser automation. In an agent setting, this can be used to read sensitive page data, alter application state, bypass intended safeguards in higher-level commands, or execute complex exfiltration logic through the page context.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill documents saving screenshots, PDFs, recordings, traces, and session state to disk without warning that these artifacts may contain credentials, personal data, tokens, or internal application content. In agent workflows, silent persistence of browser-derived data materially increases the chance of unintended local retention or later disclosure.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documented support for setting headers, credentials, cookies, local storage, and loading saved auth state enables direct handling of secrets and authenticated session material, but the skill provides no privacy or credential-handling guidance. This makes accidental credential exposure, reuse of stolen session state, or insecure persistence/import of authentication artifacts more likely.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.