T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:11- Finding
Automatic Use of a Persistent Authenticated Browser Profile
- Content
View full analysis
- Remediation
View remediation
Security audit
Persistent Browser Scraper
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it uses a persistent logged-in browser profile for broad browsing requests and includes unsafe profile-handling instructions.
Install only if you intentionally want agents to browse with the main-identity logged-in browser profile. Prefer a dedicated automation profile, require explicit confirmation before authenticated browsing, remove --no-sandbox, and do not delete SingletonLock unless you have verified the profile is not in use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:27- Finding
Chromium Sandbox Disabled While Processing Untrusted Web Content
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:18- Finding
Unconditional Deletion of Chromium Profile Concurrency Lock
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill advertises use of a persistent browser profile (
main-identity) but does not warn that it will access and modify a logged-in local browser state. Because the skill is user-invocable and designed for authenticated sites, the missing disclosure materially increases the risk of unintended access to private account data or actions performed under the user's identity.- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The explicit
rm -fcommand performs destructive filesystem modification on a local browser-profile path, which is a classic tool-parameter abuse pattern when embedded in an auto-triggerable skill. In this skill's context, it is more dangerous because it targets a persistent authenticated profile, so misuse or path changes could damage browser state, interfere with live sessions, or enable unsafe operational habits around shell-based deletion.- Content
每次抓取前先删 SingletonLock：
bash rm -f /home/kncao/.openclaw/browser-profiles/main-identity/SingletonLock标准模板
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions direct deletion of a local file (
SingletonLock) in the user's browser profile without any user-facing notice or safety checks. Even though the target path is specific, silently modifying files under a persistent profile can disrupt running browser sessions, cause state corruption, or normalize unsafe file-deletion behavior in agent skills.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger conditions are broad enough to auto-activate the skill for generic requests like 'search the web' or when certain sites are merely mentioned, causing use of a persistent logged-in browser without explicit user awareness. In this context, that can unintentionally expose authenticated content, cookies-backed session data, or actions tied to the operator's identity on third-party sites.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The natural-language content of the skill is entirely in Chinese, including the description, trigger conditions, and operational notes, without indicating that language choice is optional or user-configurable. This can violate language/locale policy where skills should not impose a specific language absent opt-in or a documented regional justification.
- Content