ClawHub
Back to skill

Security audit

ego-browser · Windows浏览器自动化

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is coherent for its purpose, but it grants agents access to existing logged-in browser sessions and live-page JavaScript without enough user control or privacy warning.

Install only if you are comfortable letting the agent act inside logged-in browser sessions. Use separate browser profiles or isolated accounts for sensitive sites, avoid running it on financial/admin systems unless you can supervise actions, and review any learnings files that may store site-specific operational details.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill advertises reuse of Chrome login state via persistent storageState without any privacy or security warning, meaning an agent can inherit existing authenticated sessions and act as the user on SaaS, CRM, or internal systems. In this skill's context, that is especially dangerous because it combines persistent authenticated access with automation primitives for navigation, clicking, form submission, and script execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly exposes a helper that executes arbitrary JavaScript in the live page context, enabling direct DOM manipulation and access to page data beyond the safer snapshot-and-ref interaction model. In a browser automation skill that is intended to operate on authenticated sites, this materially increases the risk of unsafe actions, data extraction, and bypass of guardrails if an agent or downstream caller uses it on sensitive pages.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.