ClawHub
Back to skill

Security audit

ego-browser

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill needs review because its installer weakens macOS protections and its cookie-cleaning example can sign you out of unintended websites.

Review the installer before allowing it to run. Require explicit approval for privileged changes and retain normal macOS security checks with publisher verification. Use a separate browser profile where practical, and replace the cookie recipe with exact cookie-name, domain, and path selection. The bundled scripts were inspected despite partial scanner coverage, but the downloaded browser and runtime-generated instructions were not included and could not be assessed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

Installing a browser dependency is reasonably related to browser automation, but silently extending that workflow to quarantine removal and privileged application replacement crosses a materially different trust boundary. The referenced installer implements these behaviors, while this entry point provides no warning or explicit approval requirement; access to logged-in browser sessions increases the consequences of installing compromised software.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The recipe described as deleting one specific cookie instead deletes every cookie on matching domains.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The recipe promises deletion of one specific cookie but enumerates the profile's cookies and deletes every cookie whose domain contains "example.com", without checking the cookie name. Substring matching can also select unrelated domains, causing unintended session loss in the user's shared browser profile despite the surrounding guidance favoring narrowly scoped operations.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
90% confidence
Finding

This helper automatically retries failed operations with sudo, and its callers include recursive application deletion, quarantine removal, and system-targeted installation of a downloaded package. Elevation is not inherently unsafe, but this workflow applies it without an explicit artifact-publisher verification gate or a separate informed approval step; a compromised package could execute installer scripts as root.

Content

Scanner excerpt · scripts/install.sh (reported line 42)May include surrounding context.

sh
}

run_with_sudo_if_needed() {
	# Try without elevated privileges first; fall back to sudo to avoid unnecessary prompts.
	if "$@"; then
		return 0
	fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 51)May include surrounding context.

sh
return 1
	fi

	require_command sudo
	sudo "$@"
}

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
93% confidence
Finding

This is the actual privileged execution point for operations including installation of a downloaded package onto the system volume. Although sudo still enforces its own authorization policy, the script supplies no explicit publisher-verification gate or informed confirmation before retrying, creating a path for compromised installation content to run with root privileges.

Content

Scanner excerpt · scripts/install.sh (reported line 52)May include surrounding context.

sh
fi

	require_command sudo
	sudo "$@"
}

cleanup() {

The browser installer removes macOS quarantine protections, a capability not justified by browser automation.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The installer recursively removes quarantine attributes from an existing application, potentially using sudo, and also removes them from the staged download before launch. This suppresses an important macOS first-launch security control without explicit publisher verification, increasing the risk from a substituted or compromised browser that can access authenticated sessions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/install.sh (reported line 148)May include surrounding context.

sh
}

install_ego_lite() {
	require_command curl
	require_command hdiutil

	# Download and mount the DMG in an isolated temp directory to avoid polluting the CWD.