ClawHub
Back to skill

Security audit

Playwright Service

Security checks for vulnerabilities and agentic risk

Overview

This skill does useful web capture and scraping work, but it can send screenshots to a fixed Telegram group and use an unrestricted browser service without clear user confirmation or scoping.

Install only if you trust the operator of the Playwright service and the Telegram group. Do not use it on authenticated, internal, personal, or confidential pages unless you first change the workflow to keep screenshots local, confirm the recipient, and restrict allowed URLs.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:39
Finding

Arbitrary URL Fetching Enables Server-Side Request Forgery

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-57
Vulnerability Type: Unrestricted server-side URL navigation
Risk Level: High

Vulnerable Code

bash
curl -s -X POST http://192.168.0.9:3000/title \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'
bash
# Toàn bộ text
curl -s -X POST http://192.168.0.9:3000/scrape \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

# Theo CSS selector
curl -s -X POST http://192.168.0.9:3000/scrape \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com","selector":"h1"}'

Technical Analysis

The documented Playwright service accepts a caller-controlled url and navigates to it from the service's network context. The skill does not require validation of the URL scheme, hostname, resolved IP address, port, or redirect destination.

Consequently, a user able to invoke the skill may replace https://example.com with a loopback, link-local, private-network, or cloud metadata address. The /scrape, /title, and screenshot operations could then expose information from resources that are reachable by the Playwright service but not directly reachable by the user.

The actual server implementation is not included in the audited project, so server-side mitigations cannot be verified. The vulnerability is established at the skill-instruction level because the documented workflow permits unrestricted destination input and specifies no safety checks.

Attack Path

  1. An attacker supplies a URL pointing to an internal HTTP service, loopback interface, private address, or metadata endpoint.
  2. The agent sends that URL to the Playwright service at 192.168.0.9:3000.
  3. The service navigates to the destination from its privileged network position.
  4. The attacker uses /scrape, /title, or /screenshot to capture the response.
  5. Returned text, metadata, or ...[truncated 561 chars]
Remediation
View remediation

Remediation Suggestions

  • Enforce a strict server-side allowlist of approved HTTPS origins.
  • Reject loopback, link-local, private, reserved, multicast, and cloud metadata address ranges.
  • Resolve hostnames and validate every resulting IPv4 and IPv6 address before navigation.
  • Repeat destination validation after every redirect to prevent redirect-based bypasses.
  • Reject non-HTTP(S) schemes and URLs containing unexpected credentials or ports.
  • Run the browser in an isolated network segment without access to internal systems or metadata services.
  • Add authentication, authorization, rate limiting, request logging, and abuse monitoring to the service.
  • Do not rely solely on client-side or skill-text validation, because callers may invoke the endpoint directly.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:30
Finding

Screenshots Are Directed to a Hard-Coded Telegram Group

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30-33
Vulnerability Type: Unsafe external transmission to a fixed recipient
Risk Level: Medium

Vulnerable Code

text
Sau khi có file, gửi vào Telegram group:
message tool: action=send, filePath=/root/.openclaw/workspace/screenshot.jpg, channel=telegram, target=-1003778746127

Technical Analysis

The skill instructs the agent to transmit generated screenshots to the fixed Telegram target -1003778746127. It does not require the user to select or confirm the destination, review the screenshot, or assess whether the captured page contains private information.

This behavior creates an unsafe data-disclosure path. Any screenshot generated from an internal, authenticated, or otherwise sensitive page may be sent to the predefined group merely because the agent follows the documented workflow. The audit cannot determine the group's ownership or membership, so it cannot establish that the recipient is authorized to receive every screenshot.

Attack Path

  1. A user or attacker asks the agent to capture a page containing sensitive information.
  2. The Playwright service renders the page and saves it as /root/.openclaw/workspace/screenshot.jpg.
  3. The agent follows the skill instruction and sends the file to Telegram target -1003778746127.
  4. Every member or integration with access to that group can receive or retain the screenshot.

Impact Assessment

The exposed scope is the complete visible content of each transmitted screenshot. Depending on the target page, this may include personal data, internal dashboards, account details, confidential documents, session-specific information, or infrastructure data. This issue does not itself grant local system privileges, but it can disclose information accessible through the agent or browser context to an externally configured recipient.

Remediation
View remediation

Remediation Suggestions

  • Remove the hard-coded Telegram target from the skill.
  • Require the user to explicitly select and confirm the recipient for each transmission.
  • Display the destination and file path before invoking the messaging tool.
  • Default to retaining screenshots locally rather than transmitting them automatically.
  • Require additional confirmation when screenshots originate from internal, authenticated, or sensitive pages.
  • Apply content classification or redaction to secrets, personal data, tokens, and account information before sending.
  • Use access-controlled, expiring storage where external delivery is not necessary.
  • Record recipient confirmation and transmission events in an audit log.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:7
Finding

Playwright Service Uses an Unauthenticated Plaintext HTTP Endpoint

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-9
Vulnerability Type: Unencrypted and undocumented authentication for a sensitive internal service
Risk Level: Medium

Vulnerable Code

text
## Endpoint

http://192.168.0.9:3000

All documented requests use this plaintext endpoint without an authentication header, including:

bash
curl -s -X POST http://192.168.0.9:3000/screenshot \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com","fullPage":false}'

Technical Analysis

The skill communicates with the browser automation service over unencrypted HTTP. None of the documented requests includes an authentication credential, signed request, or other authorization mechanism.

A party with access to the relevant network path may observe requested URLs, alter requests, modify returned content, or impersonate the service. If the endpoint itself follows the documented access model and lacks server-side authentication, any network peer able to reach it may also invoke its browser and scraping capabilities.

Because only SKILL.md is present, the audit cannot verify whether authentication or transport protection exists outside the documented interface. However, the provided workflow neither uses nor requires those controls.

Attack Path

  1. An attacker obtains access to the same network segment or another position on the route to 192.168.0.9.
  2. The attacker observes or modifies plaintext HTTP requests sent by the agent.
  3. Requested destinations and returned scraped content may be exposed or changed in transit.
  4. Alternatively, if the service has no undocumented server-side authentication, the attacker sends requests directly to its screenshot, title, or scrape endpoints.
  5. The attacker abuses the service's browser and network access or causes the agent to consume manipulated output.

Impact Assessment

Network-positioned attackers may obtai ...[truncated 351 chars]

Remediation
View remediation

Remediation Suggestions

  • Expose the service exclusively through authenticated HTTPS.
  • Use certificates issued by a trusted internal authority and validate certificates on every client request.
  • Require short-lived service credentials or mutual TLS rather than relying on network location.
  • Implement per-user or per-agent authorization for screenshot, title, and scraping operations.
  • Restrict the endpoint with firewall rules and place it on a dedicated, isolated network.
  • Add rate limits, request size limits, timeout controls, and comprehensive security logging.
  • Avoid documenting examples that disable TLS verification or omit mandatory authentication.
  • Rotate credentials and investigate request logs if the endpoint has previously been reachable without authorization.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs users to send captured screenshots to a Telegram group, but the description does not clearly warn that page contents may be disclosed to third parties. Screenshots can contain sensitive account data, internal dashboards, or personal information, so forwarding them to an external chat channel creates a real confidentiality risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The workflow directs operators to forward screenshots of scraped web content to an external Telegram group, creating a direct exfiltration path for collected data. Because screenshots may include sensitive or proprietary information, this external disclosure can violate privacy expectations and leak internal content beyond the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

Chụp ảnh một trang web và gửi vào Telegram.

bash
curl -s -X POST http://192.168.0.9:3000/screenshot \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com","fullPage":false}' \
  -o /root/.openclaw/workspace/screenshot.jpg

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

Most of the skill's natural-language instructions and notes are presented only in Vietnamese. This can violate a language/locale policy when the skill does not provide user opt-in, an alternative language, or a documented justification for being locale-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.