ClawHub
Back to skill

Security audit

Agent Browser

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent browser-automation guide with sensitive browser/session capabilities that users should handle carefully, but I found no hidden, deceptive, or destructive instructions.

Before installing, confirm you trust the npm package or upstream repository and use this skill only on sites/accounts you intend the agent to control. Treat saved state files, traces, recordings, screenshots, PDFs, cookies, and storage output as sensitive data; avoid committing or sharing them, and prefer isolated sessions for important accounts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill documents `agent-browser eval`, which enables arbitrary JavaScript execution in the page context. That capability exceeds simple browser automation and can be used to read or manipulate DOM state, localStorage/sessionStorage, tokens, and page data in ways not clearly reflected by the skill’s high-level description, increasing the risk of misuse or prompt-driven overreach.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The `--cdp` option allows attachment via Chrome DevTools Protocol, which grants broad browser inspection and control beyond the advertised navigate/click/type/snapshot workflow. CDP access can expose page internals, cookies, storage, network data, and debugging features that materially expand the skill’s power and attack surface.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill encourages saving and loading browser session state (`auth.json`) without warning that the file may contain authentication cookies, tokens, or other sensitive session material. Persisting this state to disk creates a replayable credential artifact that could be copied, mishandled, or committed to source control.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill documents saving screenshots, PDFs, videos, and traces to files but does not warn that these artifacts can capture sensitive page contents, credentials, personal data, cookies in traces, or internal application details. In an agent context, automatic artifact generation can silently persist confidential data to disk or logs.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.