ClawHub
Back to skill

Security audit

Daxiang Dogfood

Security checks for vulnerabilities and agentic risk

Overview

This web-testing skill has a coherent QA purpose, but it can interact with real applications, capture sensitive evidence, and save login state without enough safeguards.

Install only if you will use it on applications you are authorized to test. Avoid using production admin accounts, choose a private output directory, treat screenshots/videos/reports/auth-state.json as sensitive, delete saved session state after use, and avoid the npx tool path unless the package source and version are controlled.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:40
Finding

Shell Command Injection Through Unsafe Placeholder Interpolation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:40-54, with additional affected command templates at SKILL.md:61-67, SKILL.md:74-75, SKILL.md:82-84, SKILL.md:103-107, and SKILL.md:126-152
Vulnerability Type: Shell command injection
Risk Level: Medium

Vulnerable Code

bash
mkdir -p {OUTPUT_DIR}/screenshots {OUTPUT_DIR}/videos
bash
cp {SKILL_DIR}/templates/dogfood-report-template.md {OUTPUT_DIR}/report.md
bash
agent-browser --session {SESSION} open {TARGET_URL}
agent-browser --session {SESSION} wait --load networkidle

Additional affected examples include:

bash
agent-browser --session {SESSION} fill @e1 "{EMAIL}"
agent-browser --session {SESSION} fill @e2 "{PASSWORD}"
agent-browser --session {SESSION} state save {OUTPUT_DIR}/auth-state.json
agent-browser --session {SESSION} screenshot --annotate {OUTPUT_DIR}/screenshots/initial.png
agent-browser --session {SESSION} record start {OUTPUT_DIR}/videos/issue-{NNN}-repro.webm

Technical Analysis

The Skill instructs an agent to interpolate user-supplied or dynamically generated values directly into Bash commands. Variables such as TARGET_URL, OUTPUT_DIR, SESSION, EMAIL, PASSWORD, and generated file names are not subject to a documented validation or shell-safe escaping process.

Several placeholders are entirely unquoted. Consequently, whitespace, shell separators, redirection operators, command substitutions, and other metacharacters may be interpreted as shell syntax rather than literal argument content.

Double quotes around credential placeholders do not provide complete protection. If an interpolated value contains a double quote, command substitution, or backticks, it may terminate or alter the intended shell argument. The underlying issue is constructing shell command text from untrusted values instead of passing arguments through a structured process-execution interface.

Attack Pa

...[truncated 1548 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not construct Bash command strings by directly interpolating user-controlled data.
  2. Invoke agent-browser and filesystem operations through APIs that accept structured argument arrays without invoking a shell.
  3. If shell execution is unavoidable, apply robust shell escaping to every substituted value and place every path and argument in quotes.
  4. Validate parameters using strict allowlists:
    • Accept only http and https URLs parsed by a URL library.
    • Restrict session names and generated page names to a conservative pattern such as [A-Za-z0-9._-]+.
    • Resolve output paths and require them to remain inside an approved base directory.
    • Reject control characters, shell metacharacters, traversal segments, and unexpected newlines.
  5. Treat credentials as opaque secrets and never interpolate them into shell command text.
  6. Add explicit Skill instructions prohibiting execution when a supplied value cannot be represented safely.
  7. Add tests covering spaces, quotes, semicolons, pipes, redirection operators, command substitutions, newlines, and path traversal.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:59
Finding

Authentication Secrets Exposed Through Process Arguments and Unprotected State Storage

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:59-75
Vulnerability Type: Insecure credential handling and sensitive session-state storage
Risk Level: Medium

Vulnerable Code

bash
agent-browser --session {SESSION} snapshot -i
# Identify login form refs, fill credentials
agent-browser --session {SESSION} fill @e1 "{EMAIL}"
agent-browser --session {SESSION} fill @e2 "{PASSWORD}"
agent-browser --session {SESSION} click @e3
agent-browser --session {SESSION} wait --load networkidle
bash
agent-browser --session {SESSION} state save {OUTPUT_DIR}/auth-state.json

Technical Analysis

The Skill directs the agent to include the user's email address and password directly in command-line arguments. Depending on the execution environment, command-line arguments may be exposed through process inspection, shell history, AI tool-call transcripts, audit logs, debugging telemetry, or command wrappers.

After authentication, the Skill saves browser state to a predictable file named auth-state.json beneath a user-selectable output directory. It does not require restrictive directory or file permissions, verify that the destination is private, obtain explicit consent for persistent credential storage, define a retention period, or provide secure cleanup instructions.

Browser authentication state may contain cookies or tokens that provide access equivalent to an active authenticated session. Protecting the password alone is therefore insufficient if the saved state remains readable by unauthorized local users or processes.

Attack Path

  1. A user supplies credentials for a target web application.
  2. The agent follows the Skill and passes the password and email address as command-line arguments to agent-browser.
  3. A local process, command logger, execution transcript, telemetry system, or other observer captures those arguments.
  4. Following successful authentication, the agent writes reusa ...[truncated 1163 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not pass passwords, one-time codes, tokens, or other secrets through command-line arguments.
  2. Use a secret-input mechanism supported by the browser tool, such as protected standard input, a dedicated secret API, or an inherited file descriptor.
  3. Ensure tool calls and transcripts redact all credential values.
  4. Save authenticated browser state only when necessary and after explicit user consent.
  5. Create a dedicated private output directory with mode 0700 and write authentication-state files with mode 0600.
  6. Resolve and validate the output path before writing, preventing placement in shared directories, symbolic-link destinations, or paths outside an approved base directory.
  7. Use a randomized state-file name rather than a predictable default where practical.
  8. Encrypt stored authentication state using an appropriate secret-management facility if it must persist across runs.
  9. Define a short retention period and securely remove state when reuse is no longer required.
  10. Instruct users to revoke active sessions if credential or state-file exposure is suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill description promises full reproduction evidence including screenshots, videos, and detailed repro steps, but it does not warn that these artifacts may capture sensitive information such as PII, credentials, tokens, internal data, or authenticated content. In a testing context, this omission is dangerous because users may invoke the skill on real systems without understanding the storage and disclosure risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The instructions save authenticated browser state to {OUTPUT_DIR}/auth-state.json without any user-facing warning or safeguards. Session state files often contain cookies, tokens, and other authentication material, so storing them plainly can enable account takeover or lateral access if the file is exposed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill manifest references an MCP-capable tool pattern including npx agent-browser without a version pin. In an execution environment, this can fetch and run whatever package version is current, increasing the risk of malicious or compromised dependency execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description includes broad triggers like 'find issues', 'QA', and 'review the quality of a web application', which can cause the skill to activate in situations broader than intended. Because the skill performs systematic exploration, captures screenshots/videos, and may authenticate, accidental invocation can lead to unintended interaction with sensitive applications or data collection.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The manifest allows Bash(npx agent-browser:*), which permits invoking an unpinned package through npx. That creates supply-chain risk because the resolved package version can change over time or be influenced by registry compromise, leading to execution of unexpected code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The skill text references npx agent-browser as an available invocation path, even though it recommends not using it. Mentioning an unpinned npx execution path can normalize unsafe usage and, combined with the allowed-tools entry, contributes to supply-chain exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.