Read, Search & Extract Web Pages by Dokobot

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:22 AM UTC
• Version: 2.3.4

Overview

This skill is a disclosed browser-reading tool, but it can access logged-in Chrome pages and may route rendered private page content through Dokobot's remote service by default.

Install only if you are comfortable giving Dokobot's CLI and Chrome extension access to pages visible in your browser. Prefer explicit local mode, use a dedicated browser profile for sensitive work, verify or pin the npm package before installing, and avoid targeting email, finance, healthcare, admin, or internal sites unless you intend that content to be read.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15 and 23-24
Vulnerability Type: Supply-chain exposure through an unpinned global dependency
Risk Level: Medium

Relevant Code Snippet:

yaml

allowed-tools: Bash
metadata:
  author: dokobot
  version: "2.3.4"
  openclaw: {"requires": {"bins": ["dokobot"]}, "optionalEnv": ["DOKO_API_KEY"]}

markdown

## Prerequisites
- `@dokobot/cli` installed globally (`npm install -g @dokobot/cli`)

Technical Analysis

The Skill instructs users or agents to install @dokobot/cli globally without specifying an exact package version, integrity hash, lockfile, or immutable artifact. Although the Skill metadata declares version 2.3.4, that value does not constrain the version installed by npm install -g @dokobot/cli.

The package implementation is not included in the audited project, so its installation scripts and runtime behavior cannot be verified from this artifact. npm packages may execute lifecycle scripts during installation. A global installation also makes the resulting executable broadly available to the current user and increases the consequences of a compromised or unexpectedly modified release.

This is a supply-chain weakness rather than evidence that the named package is currently malicious.

Attack Path

1. An attacker compromises the npm package, its maintainer account, release pipeline, or another relevant distribution component.
2. The attacker publishes a modified release under the expected package name.
3. A user or agent follows the Skill instructions and runs npm install -g @dokobot/cli.
4. npm retrieves the current package version because no version or integrity value is pinned.
5. Malicious lifecycle scripts may execute during installation, or malicious behavior may run when the dokobot binary is invoked.
6. The payload executes with the permissions of the user performing the installation or running the ...[truncated 592 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a specifically audited version, for example @dokobot/cli@2.3.4, after independently verifying that release.
2. Publish and verify the expected package integrity hash or signed release provenance.
3. Prefer a project-local dependency governed by a committed lockfile instead of global installation.
4. Use npm ci with a reviewed lockfile where the deployment model permits it.
5. Review package lifecycle scripts and consider disabling them with --ignore-scripts if they are not required.
6. Verify the package publisher, official registry source, extension publisher, and repository-release relationship before installation.
7. Run the CLI under a dedicated, minimally privileged operating-system account or sandbox.
8. Establish an explicit update-review process instead of recommending an unconstrained update to the latest release.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:56

Finding

Authenticated Browser Content Can Be Transferred Through the Default Remote Mode

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4-7 and 56-60
Vulnerability Type: Overbroad access to authenticated browser content and external data transfer
Risk Level: Medium

Relevant Code Snippet:

yaml

read_when:
  - Reading web pages that require JavaScript rendering or dynamic content
  - Extracting text and structured content from single-page applications (SPAs)
  - Fetching content from pages that require a logged-in browser session
  - Searching the web for real-time information and research

markdown

### Local vs Remote mode
- `--local`: Free and unlimited. Reads through the local bridge without any server. Requires `dokobot install-bridge` and Chrome with the extension.
- Remote (default): Reads through the cloud API. Requires `DOKO_API_KEY` and Remote Control enabled in the extension.
- Prefer `--local` when the user has Chrome open locally. Use remote when accessing browsers on other machines.

Technical Analysis

The declared functionality includes reading pages through a real Chrome session, including pages accessible only after authentication. This gives the Skill access to content authorized by the user's active browser cookies and session state, potentially including private account pages, messages, internal applications, or personal information.

Remote mode is documented as the default. Consequently, a command that does not explicitly select local mode can transfer rendered page content through an external cloud service. The document states that remote content is end-to-end encrypted and that Remote Control must be manually enabled, which are meaningful mitigations. However, the relevant CLI, extension, cryptographic implementation, endpoint controls, retention behavior, and telemetry are not included in the project and therefore could not be independently verified.

Network transfer is relevant to the optional remote-browser use case, but it is not necess ...[truncated 1833 chars]

Remediation

View remediation

Remediation Suggestions

1. Make local mode the enforced default rather than merely recommending it.
2. Require an explicit --remote option for every remote operation.
3. Require clear, per-request user confirmation before accessing authenticated pages or sending their content through remote infrastructure.
4. Display the complete destination URL, selected browser or device, operating mode, and remote endpoint before execution.
5. Use an origin allowlist and deny sensitive origins by default, including email, financial, identity, healthcare, administrator, and internal application domains.
6. Use a dedicated browser profile with only the sessions needed for the current task.
7. Minimize extension host permissions and avoid unrestricted access to all sites where technically possible.
8. Add automatic detection and redaction for credentials, tokens, personal data, and sensitive form or account fields.
9. Document encryption design, metadata exposure, telemetry, retention, deletion, remote-device authorization, and key-management behavior.
10. Provide an obvious indicator and cancellation control whenever a remote browser operation is active.
11. Close remote read sessions promptly after use and expire inactive sessions automatically.
12. Treat content read from websites as untrusted data and prevent page content from directing additional authenticated navigation without separate authorization.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.