ClawHub
Back to skill

Security audit

Claw Browser

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent browser helper, but it lets an agent open and read arbitrary URLs from the local runtime without destination safeguards.

Use this skill only in an isolated environment where arbitrary browser navigation is acceptable. Confirm destinations before opening untrusted, internal, or authenticated pages; treat printed page text and evidence.png as potentially sensitive; and pin or lock Playwright before relying on repeatable installs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
browser.py:20
Finding

Unrestricted Browser Navigation Enables Server-Side Request Forgery

Content
View full analysis

Vulnerability Details

File Location: browser.py:20-31
Vulnerability Type: Unrestricted URL navigation and internal-resource access
Risk Level: Medium

Vulnerable Code

python
print("🚀 Navigating to page...")
page.goto(url, wait_until="domcontentloaded", timeout=60000)

# Wait for dynamic content
time.sleep(2)

if action == "read":
    print("📖 Reading content...")
    title = page.title()

    # Extract body text and clean up
    content = page.evaluate("document.body.innerText")
    clean_content = ' '.join(content.split())[:5000]

The untrusted URL originates from the command-line argument defined at browser.py:49:

python
parser.add_argument("--url", required=True, help="URL to visit")

Technical Analysis

The caller controls the URL passed directly to Playwright's page.goto() method. The application does not validate the URL scheme, hostname, resolved IP address, destination port, or redirects before Chromium performs the request.

Consequently, Chromium can potentially access network resources reachable from the runtime environment, including:

  • Loopback services such as 127.0.0.1
  • Private network addresses
  • Link-local services
  • Cloud instance metadata endpoints
  • Administrative web interfaces exposed only to the local network

When the read action is selected, the application extracts document.body.innerText and prints up to 5,000 characters. This creates an SSRF-style read primitive for resources whose responses can be rendered by Chromium. Browser security controls may limit some response handling, but they do not prevent top-level navigation to ordinary internal HTTP services.

Redirect destinations are not independently validated, so validating only the initial hostname would not be sufficient.

Attack Path

  1. An attacker or untrusted workflow supplies a URL targeting an internal resource, such as http://127.0.0.1:PORT/, a priva ...[truncated 1138 chars]
Remediation
View remediation

Remediation Suggestions

  1. Accept only explicitly supported schemes, preferably https and, where necessary, http.
  2. Reject URLs containing embedded credentials, malformed hostnames, or unsupported ports.
  3. Resolve the destination hostname before navigation and reject every address in loopback, private, link-local, multicast, reserved, and unspecified ranges for both IPv4 and IPv6.
  4. Explicitly block cloud metadata destinations, including link-local metadata addresses and provider-specific metadata hostnames.
  5. Validate every redirect destination rather than only the original URL.
  6. Prevent DNS rebinding by ensuring the address used for the connection remains within the validated public address set.
  7. Prefer an explicit domain allowlist when the expected browsing destinations are known.
  8. Apply network-level egress controls so the browser process cannot reach internal networks or metadata services, providing defense in depth.
  9. Run Chromium in an isolated, least-privileged environment with no access to sensitive local services.
  10. Return a clear error and nonzero exit status when a destination is rejected or navigation fails.

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Playwright and Browser Dependencies Create Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned executable third-party dependency
Risk Level: Medium

Vulnerable Code

text
playwright

The installation instructions at SKILL.md:42-45 automatically resolve the dependency and download browser binaries:

bash
pip install -r requirements.txt

# 4. Download Chromium binaries (CRITICAL STEP)
playwright install chromium

Technical Analysis

The dependency declaration does not specify a Playwright version or an integrity hash. Each installation can therefore resolve to a different package version from the configured Python package index. The subsequent Playwright command also downloads a Chromium build associated with the dynamically selected Playwright release.

This makes installations non-reproducible and means executable code can change without any modification to the audited project. If the package index, publisher account, dependency resolution path, or downloaded browser artifacts are compromised, malicious code could execute when the dependency is imported or its command-line interface is invoked.

No evidence establishes that the current Playwright package is malicious. The confirmed weakness is the absence of version and integrity controls around executable third-party components.

Attack Path

  1. A user follows the documented setup procedure.
  2. pip install -r requirements.txt resolves whichever Playwright release is currently selected by the configured package index.
  3. A compromised, substituted, or unexpectedly changed package is installed without hash verification.
  4. playwright install chromium invokes the installed package and downloads an associated browser binary.
  5. The project imports playwright.sync_api, or the installation command invokes package-controlled logic.
  6. Compromised dependency code executes with the privileges of the user performing installation or r ...[truncated 555 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin Playwright to a specifically reviewed version, for example with an exact == constraint.
  2. Generate a lock file that includes all transitive dependencies.
  3. Record cryptographic hashes and install with pip's --require-hashes option.
  4. Use a trusted, controlled package index or internal artifact repository.
  5. Pin and verify the Chromium revision associated with the approved Playwright release.
  6. Cache approved browser artifacts internally and verify their integrity before installation where deployment requirements permit.
  7. Run dependency installation as a non-privileged user in an isolated build environment.
  8. Add automated dependency vulnerability and provenance scanning.
  9. Review and deliberately update the lock file instead of automatically accepting newly published versions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description highlights rendering, screenshots, and visible browsing but omits warnings about the privacy, security, and resource risks of loading arbitrary URLs in a real browser. Without explicit cautions, agents or operators may treat the skill as routine, leading to visits to attacker-controlled pages, exposure of local session context, or accidental capture of sensitive information in screenshots.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill's trigger guidance is broad enough that an agent may invoke a full browser for routine requests such as 'open' or 'see' a website, increasing the chance of unnecessary navigation to arbitrary third-party URLs. In an agent setting, this expands exposure to tracking, sensitive-content rendering, and unintended side effects from visiting attacker-controlled pages, even if the skill itself is not overtly malicious.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency is specified without a version pin, so installs may pull different Playwright releases over time. That weakens reproducibility and can introduce breaking changes or newly introduced vulnerable/transitive code into the skill unexpectedly, which is a real supply-chain risk even though the file itself is minimal.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
playwright

Static analysis

No suspicious patterns detected.