ClawHub
Back to skill

Security audit

WebSculpt: Browser Automation with Memory

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent WebSculpt bootstrap skill, but it can globally install software and agent skills into user home directories from broad triggers without a clear consent checkpoint.

Review this carefully before installing. It is not evidence of malware, but it will change your environment by installing global npm packages and persistent agent skills under your home directory. Prefer project-local installation if you only need WebSculpt in one workspace, and only proceed if you are comfortable letting future agent sessions use the installed WebSculpt lifecycle skills automatically.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill directs the agent to perform global npm installation and write skill files into user home directories, changing the system environment without requiring an explicit user confirmation at the point of modification. Because this is a bootstrap skill that can be triggered as part of task routing, it increases the risk of unauthorized persistence, package-supply-chain exposure, and surprising system changes on the user's machine.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Prohibited

- Do not run any install command before probing (`websculpt --version` / `websculpt skill status`).
- Do not reinstall when the CLI and skills are already healthy, and do not ask the user to restart the session; route and continue the task directly.
- Do not use sudo to work around npm global install permission errors; use the npx fallback instead.
- Do not hand-edit the four installed lifecycle skill files; they are refreshed exclusively via `websculpt skill install --force`.
Confidence
88% confidence
Finding
The instruction to proceed automatically and 'not ask the user' encourages autonomous continuation into routing and potentially additional actions after probing or installation. In a skill that can install software, read local skill files, and continue multi-step workflows, reducing user checkpoints makes unintended or over-broad actions more likely.

Static analysis

No suspicious patterns detected.