ClawHub

Agent Browser Bwm

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed browser-automation skill, with sensitive cookie and session-state handling that is expected for its purpose but should be treated carefully.

Install only if you trust the external agent-browser npm package and Chromium download. Use dedicated test accounts where practical, avoid printing or committing cookies, localStorage, or saved auth JSON files, and delete saved browser state when it is no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly documents saving and loading browser authentication state, which commonly includes cookies and local/session storage tokens, but provides no warning that these files may contain reusable session secrets. In an agent context, this makes credential material easy to persist, copy, or reuse across tasks, increasing the risk of account takeover or unintended cross-user access if the state files are mishandled.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation exposes commands for reading and modifying cookies and browser storage without any notice that these sources may contain authentication tokens, PII, CSRF material, or other secrets. Because this skill is specifically designed for agent-driven browser automation, normalizing unrestricted cookie/storage access without guardrails increases the chance an agent will extract, alter, or leak sensitive browser data.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal