ClawHub
Back to skill

Security audit

Daxiang Electron

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Electron app automation, but it normalizes powerful desktop-app control through unprotected debugging ports and unpinned runtime tooling without enough user safeguards.

Install only if you understand that this can let an agent inspect and control authenticated desktop apps. Use it on trusted machines, prefer isolated test profiles, avoid highly sensitive apps, verify debugging ports are local-only and closed after use, and prefer a pinned or reviewed agent-browser installation over runtime npx resolution.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:4
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Unpinned runtime dependency execution
Risk Level: Medium

Vulnerable Code:

yaml
allowed-tools: Bash(agent-browser:*), Bash(npx agent-browser:*)

Technical Analysis

The Skill explicitly permits execution of npx agent-browser without requiring an exact package version, a lockfile integrity value, or a previously reviewed local installation. Depending on the environment and local cache state, npx can download a package from an external package registry and execute its lifecycle or runtime code.

Consequently, the code executed when the Skill is invoked can differ from the code that existed during this audit. A compromised publisher account, registry compromise, malicious future package release, dependency confusion condition, or package-name takeover could introduce arbitrary code into the agent environment.

This is an insecure dependency and supply-chain exposure. The available evidence does not establish that the current agent-browser package is malicious; the vulnerability is the authorization of mutable, unpinned code retrieval and execution.

Attack Path

  1. An attacker compromises the package publisher, distribution channel, or one of the package's transitive dependencies.
  2. The attacker publishes a malicious release under the package name resolved by npx agent-browser.
  3. An agent loads this Skill and invokes the permitted npx agent-browser command.
  4. npx retrieves or resolves the attacker-controlled package version.
  5. Package lifecycle scripts or runtime code execute with the privileges of the agent process.
  6. The malicious package can access files, environment variables, credentials, and network resources available to that process.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the operating-system account running the agent. The accessible scope cou ...[truncated 358 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove Bash(npx agent-browser:*) from the allowed tools.
  2. Install agent-browser as a reviewed local dependency rather than downloading it during Skill execution.
  3. Pin the dependency and all transitive dependencies to exact versions in a committed lockfile.
  4. Verify package integrity through lockfile hashes or an approved artifact repository.
  5. Disable package lifecycle scripts during installation unless they have been independently reviewed and are required.
  6. Use a private or allowlisted package registry with provenance verification.
  7. Run the tool in a restricted environment with minimal filesystem, credential, and network access.
  8. Establish a controlled dependency-update process that requires security review before changing the pinned version.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:21
Finding

Electron Applications Exposed Through Unprotected Chrome DevTools Protocol Ports

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-24; additional affected examples at lines 40-68 and 117-118
Vulnerability Type: Unprotected debugging interface and potentially unsafe sensitive-data handling
Risk Level: High

Primary Vulnerable Code:

bash
# Launch an Electron app with remote debugging
open -a "Slack" --args --remote-debugging-port=9222

# Connect agent-browser to the app
agent-browser connect 9222

Additional Launch Examples:

bash
# Slack
open -a "Slack" --args --remote-debugging-port=9222

# VS Code
open -a "Visual Studio Code" --args --remote-debugging-port=9223

# Discord
open -a "Discord" --args --remote-debugging-port=9224

# Figma
open -a "Figma" --args --remote-debugging-port=9225

# Notion
open -a "Notion" --args --remote-debugging-port=9226

# Spotify
open -a "Spotify" --args --remote-debugging-port=9227
bash
slack --remote-debugging-port=9222
code --remote-debugging-port=9223
discord --remote-debugging-port=9224
bash
"C:\Users\%USERNAME%\AppData\Local\slack\slack.exe" --remote-debugging-port=9222
"C:\Users\%USERNAME%\AppData\Local\Programs\Microsoft VS Code\Code.exe" --remote-debugging-port=9223

Sensitive Data Extraction Example:

bash
agent-browser snapshot -i
agent-browser get text @e5
agent-browser snapshot --json > app-state.json

Technical Analysis

The Skill directs users to relaunch authenticated Electron applications with Chrome DevTools Protocol enabled on predictable ports. CDP is a privileged application-control interface: a client that can reach it may enumerate application targets, inspect rendered content, read page state, execute actions in authenticated application windows, and manipulate the interface.

The instructions do not require explicit loopback binding, verification of the listener address, authentication, firewall restrictions, an isolated test profil ...[truncated 2427 chars]

Remediation
View remediation

Remediation Suggestions

  1. Explicitly bind debugging endpoints to the loopback interface and verify the actual listener address before connecting.
  2. Block the debugging ports at host and network firewalls; never expose them on public or shared network interfaces.
  3. Use randomized, short-lived ports instead of predictable fixed ports.
  4. Use isolated application profiles containing only test data rather than users' normal authenticated profiles.
  5. Prohibit automation of highly sensitive applications, particularly password managers, unless an explicit security review and user authorization are completed.
  6. Require informed user confirmation before sending messages, changing settings, accessing secrets, or performing other consequential actions.
  7. Terminate the Electron application or debugging endpoint immediately after the automation task completes.
  8. Add cleanup procedures that verify the debugging listener is no longer active.
  9. Avoid persisting full application snapshots unless necessary. When persistence is required, use a protected directory, restrictive file permissions, encryption where appropriate, data minimization, and secure deletion.
  10. Detect and reject connections to unexpected targets so that an occupied or spoofed fixed port cannot redirect automation to the wrong application.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description includes broad triggers such as controlling desktop apps, connecting to running apps, and testing Electron applications, which can cause the skill to be invoked in many contexts without sufficient user intent verification. Because this skill enables powerful desktop automation and remote debugging exposure, overbroad routing materially raises the chance of unsafe or privacy-invasive actions on sensitive local applications.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

This finding is effectively the same underlying issue reflected in the manifest context: the skill references npx agent-browser without an exact version pin. Unpinned runtime package resolution increases exposure to malicious package updates, account compromise of the publisher, or unexpected behavioral drift.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The manifest allows invoking npx agent-browser:* without pinning an exact package version, which means future executions may fetch whatever version is current at runtime. That creates a supply-chain risk: a compromised or breaking upstream release could gain code execution in the agent's tool context or alter automation behavior unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs users to launch desktop applications with --remote-debugging-port but does not warn that this exposes a powerful debugging interface that may permit inspection and control of app contents, including authenticated sessions and sensitive data. In the context of Slack, VS Code, Notion, Discord, and similar apps, that omission is especially dangerous because it normalizes opening a high-privilege local control channel without discussing access restrictions, network exposure, or the need to close it promptly.

Content

No source excerpt is available for this finding.