Security audit

openclaw-browser-extension-clicker

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it needs review because it can control the desktop and optionally save full-screen screenshots with limited safeguards.

Install only if you are comfortable granting desktop automation and screen-recording permissions. Use dry-run or calibration first, keep the intended browser window focused, avoid visible passwords or sensitive documents when using screenshots, and prefer pinned dependency versions in an isolated virtual environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:16
Finding: Unpinned Third-Party Python Dependencies
Content: View full analysis
Remediation: View remediation
Pillow== ``` 2. Generate a lock file that includes all transitive dependencies rather than constraining only direct dependencies. 3. Record cryptographic hashes for every permitted distribution and enforce them during installation: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Configure installation to use an explicitly trusted package index, and prevent fallback to untrusted or unintended indexes. 5. Remove the unconstrained upgrade recommendation. Dependency updates should be reviewed, tested, and accompanied by regenerated hashes before publication. 6. Run installation and the Skill as a non-administrative user inside an isolated virtual environment. Do not use `sudo pip` or an equivalent elevated installation process. 7. Add automated dependency scanning and provenance checks to the release process. Review both direct and transitive dependency changes before updating the lock file. 8. Update `SKILL.md` and `README.md` so all documented and automated installation paths use the same locked, hash-verified dependency set. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README instructs users to grant macOS screen-recording access and use screenshot features, but it does not clearly explain the privacy implications of capturing on-screen sensitive data such as credentials, messages, or confidential documents. In the context of a GUI automation skill explicitly designed to bypass normal browser interaction boundaries, this omission increases the chance of unsafe deployment and accidental over-collection of sensitive information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This skill explicitly performs system-level GUI automation to click browser extension icons and claims it can bypass browser security restrictions. Without strong warnings, focus checks, or safety constraints, it can misclick, trigger unintended browser or OS actions, or be repurposed to interact with sensitive UI elements outside the intended extension workflow. The surrounding context increases risk because the skill is designed to operate at the desktop/UI layer rather than through browser APIs, which makes actions less deterministic and harder to constrain.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module description and user-facing behavior are presented in Chinese, and the rest of the script continues that language choice without any opt-in or alternative locale. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is justified.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill includes a full-screen screenshot function that captures far more information than is required to click a browser extension icon. In this context, the skill already uses system-level GUI automation to bypass browser/UI boundaries, so adding screen capture increases the chance of collecting sensitive on-screen data such as emails, credentials, tokens, or unrelated application content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The README is written entirely in Chinese and provides the invocation example only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The natural-language instructions and usage guidance are presented in Chinese only, which can impose a language requirement on users without opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.
Content: No source excerpt is available for this finding.