Persistent Browser Scraper

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:28 PM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it uses a persistent logged-in browser profile for broad browsing requests and includes unsafe profile-handling instructions.

Install only if you intentionally want agents to browse with the main-identity logged-in browser profile. Prefer a dedicated automation profile, require explicit confirmation before authenticated browsing, remove --no-sandbox, and do not delete SingletonLock unless you have verified the profile is not in use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:11
• Finding: Automatic Use of a Persistent Authenticated Browser Profile<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 11–15, 24, and 64–68 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High ### Vulnerable Code ```text user_data_dir = /home/kncao/.openclaw/browser-profiles/main-identity headless = False（必须，否则 X/Twitter 会返回空白） ``` ```python USER_DATA_DIR = '/home/kncao/.openclaw/browser-profiles/main-identity' ``` ```text ## 触发条件 - 用户要求「搜索外网」「搜一下」 - 用户指定以下网站：YouTube、GitHub、HuggingFace、Reddit、Kaggle、X/Twitter - 任何需要登录态才能访问的内容抓取 ``` ### Technical Analysis The skill instructs the agent to open a fixed persistent Chromium profile named `main-identity`. Such profiles can contain authenticated cookies, session tokens, local storage, browsing history, and other account-associated data. The activation criteria are broad: a generic request to search the external web or access one of several named sites can cause the skill to use this authenticated identity. The instructions do not require explicit, per-invocation consent before accessing the profile and do not restrict navigation to an allowlist of approved origins. This crosses a least-privilege boundary because an ordinary search request does not inherently require access to the user's authenticated accounts. Although the supplied template only extracts text, pages loaded through the persistent profile may expose private account content to the agent. The browser context also remains capable of performing authenticated actions if the template is extended or used interactively. ### Attack Path 1. A user, delegated task, or untrusted request asks the agent to search the web or access one of the listed sites. 2. The skill activates under its broad trigger conditions. 3. Chromium opens `/home/kncao/.openclaw/browser-profiles/main-identity`. 4. Existing cookies and session state authenticate the browser to supported websites. 5. The requested page can expose account-specific or private content to the agent. 6. If na ...[truncated 800 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit user confirmation before opening any authenticated browser profile. - Do not activate authenticated browsing for generic requests such as “search the web.” - Use an isolated, dedicated automation profile with only the minimum required website sessions. - Implement a strict allowlist for destination origins and reject redirects to unapproved origins. - Separate anonymous browsing from authenticated browsing, defaulting to the anonymous context. - Prohibit account-modifying actions unless the user separately and explicitly approves the exact action. - Restrict extracted data to the minimum required for the task and prevent unnecessary retention. - Consider copying only narrowly scoped session material into an ephemeral profile rather than opening the user's primary persistent profile. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:27
• Finding: Chromium Sandbox Disabled While Processing Untrusted Web Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27–39 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```python context = await p.chromium.launch_persistent_context( user_data_dir=USER_DATA_DIR, headless=False, args=[ "--password-store=basic", "--no-sandbox", "--disable-blink-features=AutomationControlled", "--disable-infobars" ], viewport={'width': 1280, 'height': 800}, java_script_enabled=True ) ``` ### Technical Analysis The `--no-sandbox` option disables Chromium's process sandbox, a principal security boundary used to contain compromised renderer and browser subprocesses. The skill simultaneously enables JavaScript and directs the browser to load external websites, potentially including attacker-controlled pages. If malicious web content exploits a Chromium vulnerability, disabling the sandbox can substantially reduce the number of additional protections that the attacker must bypass to reach host resources. The risk is amplified because the browser uses a persistent authenticated profile containing sensitive session state. No compensating control, such as execution inside a hardened disposable container, is documented. ### Attack Path 1. The skill navigates to an attacker-controlled or compromised webpage. 2. The page executes JavaScript in Chromium. 3. The page exploits an applicable Chromium renderer or browser vulnerability. 4. Because Chromium was started with `--no-sandbox`, the compromised process has weaker isolation from the host. 5. The attacker may attempt to access resources available to the browser's operating-system user, including the persistent browser profile and other readable files. This path requires a separate exploitable browser vulnerability; `--no-sandbox` does not by itself provide code execution. It materially increases the impact and exploitability of such a vulnerability. ### Impact Ass ...[truncated 465 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `--no-sandbox` Chromium argument. - Run Chromium as a dedicated, unprivileged operating-system user. - Keep Chromium and Playwright patched to supported versions. - If the environment cannot support Chromium sandboxing, execute the browser inside a hardened, disposable container or virtual machine. - Deny unnecessary filesystem and network access through container policies, namespaces, seccomp, and mandatory access controls where available. - Mount sensitive host directories as inaccessible and avoid sharing the primary authenticated profile with the isolated browser. - Apply destination-origin allowlisting and block navigation to untrusted schemes or local resources. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18
• Finding: Unconditional Deletion of Chromium Profile Concurrency Lock<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18–21 and 72–73 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```bash rm -f /home/kncao/.openclaw/browser-profiles/main-identity/SingletonLock ``` ```text - 每次调用前清理 SingletonLock，否则报 `ProcessSingleton` 错误 ``` ### Technical Analysis Chromium's `SingletonLock` participates in preventing multiple browser processes from concurrently opening the same user-data directory. The skill instructs operators to remove this lock unconditionally before every invocation. A lock can remain after a crash, but its existence can also indicate that another legitimate Chromium process is actively using the profile. Deleting it without validating the owning process bypasses the profile's concurrency safeguard. Concurrent processes can then read and write the same cookies, databases, preferences, and local-storage files. The command uses a fixed path and does not expose command injection. The issue is the unsafe removal of a synchronization control rather than shell metacharacter handling. ### Attack Path 1. A legitimate Chromium instance is already using the `main-identity` profile. 2. The skill is invoked while that instance remains active. 3. The prescribed command forcibly removes `SingletonLock`. 4. Playwright starts another Chromium instance against the same profile. 5. Both processes concurrently access and modify the profile. 6. Concurrent writes can cause profile corruption, inconsistent session state, data loss, or unpredictable authenticated behavior. An attacker who can repeatedly trigger the skill while the profile is in use could increase the likelihood of these effects, but the unsafe condition can also occur accidentally. ### Impact Assessment The primary impact is loss of integrity and availability of the browser profile, including corruption of cookies, local storage, preferences, and session state. It may also cause authentic ...[truncated 242 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not delete `SingletonLock` unconditionally. - Check whether the process associated with the profile is still running; abort safely if the profile is active. - Prefer a dedicated automation profile that is never shared with an interactive browser. - Serialize all access to the automation profile through an application-controlled lock. - If a stale lock is suspected, verify that no process owns or uses the profile before removing it. - Use an ephemeral copy of the profile when concurrent access cannot be avoided, while carefully limiting copied authentication data. - Back up critical profile data and handle startup failures without bypassing Chromium's safety mechanisms. ]]>

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill advertises use of a persistent browser profile (`main-identity`) but does not warn that it will access and modify a logged-in local browser state. Because the skill is user-invocable and designed for authenticated sites, the missing disclosure materially increases the risk of unintended access to private account data or actions performed under the user's identity.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

每次抓取前先删 SingletonLock：
```bash
rm -f /home/kncao/.openclaw/browser-profiles/main-identity/SingletonLock
```

## 标准模板

• Confidence: 98% confidence
• Finding: The explicit `rm -f` command performs destructive filesystem modification on a local browser-profile path, which is a classic tool-parameter abuse pattern when embedded in an auto-triggerable skill. In this skill's context, it is more dangerous because it targets a persistent authenticated profile, so misuse or path changes could damage browser state, interfere with live sessions, or enable unsafe operational habits around shell-based deletion.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The instructions direct deletion of a local file (`SingletonLock`) in the user's browser profile without any user-facing notice or safety checks. Even though the target path is specific, silently modifying files under a persistent profile can disrupt running browser sessions, cause state corruption, or normalize unsafe file-deletion behavior in agent skills.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger conditions are broad enough to auto-activate the skill for generic requests like 'search the web' or when certain sites are merely mentioned, causing use of a persistent logged-in browser without explicit user awareness. In this context, that can unintentionally expose authenticated content, cookies-backed session data, or actions tied to the operator's identity on third-party sites.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The natural-language content of the skill is entirely in Chinese, including the description, trigger conditions, and operational notes, without indicating that language choice is optional or user-configurable. This can violate language/locale policy where skills should not impose a specific language absent opt-in or a documented regional justification.

Static analysis

No suspicious patterns detected.