ClawHub
Back to skill

Security audit

Webapp Testing

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local web app testing helper, but users should treat its server commands as real local command execution.

Install this only if you want an agent to run local web testing workflows in your workspace. Review server and automation commands before execution, avoid --shell unless the command is trusted and reviewed, and keep Playwright targets to localhost or staging rather than production sites.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose frames the skill as a Playwright testing toolkit, but the content also enables process orchestration: spawning arbitrary server commands, polling ports, executing a follow-up command, and optionally using explicit shell mode. That hidden expansion of capability materially changes the risk profile because it allows arbitrary local command execution and process management beyond simple browser automation, which could be abused to run unintended programs or mask risky behavior behind a benign testing description.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

This is a true tool-parameter-abuse issue because the script explicitly allows switching into shell mode for server startup, turning a test helper into a generic command-execution primitive. If upstream agent logic passes attacker-influenced values here, the shell will interpret operators such as &&, ;, |, $(), and backticks, enabling full command injection.

Content

Scanner excerpt · scripts/with_server.py (reported line 92)May include surrounding context.

python
if use_shell:
                # Shell mode: pass command string directly to shell
                print(f"Starting server {i+1}/{len(servers)} (shell): {cmd}")
                process = subprocess.Popen(
                    cmd,
                    shell=True,
                    stdout=subprocess.PIPE,

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

This is a true tool-parameter-abuse issue because the script explicitly allows switching into shell mode for server startup, turning a test helper into a generic command-execution primitive. If upstream agent logic passes attacker-influenced values here, the shell will interpret operators such as &&, ;, |, $(), and backticks, enabling full command injection.

Content

Scanner excerpt · scripts/with_server.py (reported line 92)May include surrounding context.

python
if use_shell:
                # Shell mode: pass command string directly to shell
                print(f"Starting server {i+1}/{len(servers)} (shell): {cmd}")
                process = subprocess.Popen(
                    cmd,
                    shell=True,
                    stdout=subprocess.PIPE,

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill clearly instructs use of shell-capable operations (python ..., starting servers, and optionally --shell) but does not declare any tool scope or allowed-tools restrictions. This creates an authorization gap where an agent may invoke shell functionality more broadly than the skill metadata suggests, increasing the chance of unsafe command execution in environments that rely on metadata for enforcement or review.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation claims Playwright connects only to localhost, but the examples and instructions do not technically enforce that restriction. Because Playwright navigation is generic, an agent following this skill could be directed to non-local or production targets despite the stated safety claim, creating a misleading trust boundary and enabling unintended scanning, testing, or interaction with external systems.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

This path invokes subprocess.Popen with shell=True on a user-supplied command string. If any untrusted input can reach --server while --shell is enabled, an attacker can inject shell metacharacters and execute arbitrary commands on the host running the skill.

Content

Scanner excerpt · scripts/with_server.py (reported line 92)May include surrounding context.

python
if use_shell:
                # Shell mode: pass command string directly to shell
                print(f"Starting server {i+1}/{len(servers)} (shell): {cmd}")
                process = subprocess.Popen(
                    cmd,
                    shell=True,
                    stdout=subprocess.PIPE,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/with_server.py (reported line 109)May include surrounding context.

python
sys.exit(1)

                print(f"Starting server {i+1}/{len(servers)}: {' '.join(cmd_argv)}")
                process = subprocess.Popen(
                    cmd_argv,
                    stdout=subprocess.PIPE,
                    stderr=subprocess.PIPE

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/with_server.py (reported line 128)May include surrounding context.

python
# Run the command (always argv, no shell)
        print(f"Running: {' '.join(args.command)}\n")
        result = subprocess.run(args.command)
        sys.exit(result.returncode)

    finally:

Static analysis

No suspicious patterns detected.