PageAgent Browser Enhancement

• Outcome: Review
• Latest audit: May 28, 2026 · 2:24 PM UTC
• Version: 1.0.0

Overview

This skill is a browser automation helper, but it exposes unrestricted JavaScript execution inside any controlled web page without clear user-facing guardrails.

Install only if you are comfortable giving the agent powerful control over browser pages. Prefer an isolated OpenClaw browser profile and avoid using it on banking, admin, production, email, or other sensitive authenticated sites unless you explicitly intend that level of access. Treat execJS as a high-risk capability because it can read or change page state beyond ordinary clicks and form fills.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The injected API exposes execJS(script), which allows arbitrary JavaScript execution in the context of whatever page the agent is controlling. That capability goes beyond the stated DOM extraction and interaction purpose and can be used to read sensitive page data, tamper with application state, or invoke privileged in-page actions, making the skill materially more dangerous.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Arbitrary in-page JavaScript execution is not justified by the declared purpose of precise clicking, typing, scrolling, form filling, and DOM reading. In this context, execJS becomes a general-purpose code execution primitive inside any visited site, enabling theft of visible and hidden data, bypass of intended interaction constraints, and execution of site-specific malicious logic.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill exposes a general-purpose executeJavascript(script) capability that evaluates arbitrary code in the page context, which goes beyond the declared purpose of structured DOM interaction such as clicking, typing, scrolling, and extraction. In an agent skill that can be invoked on arbitrary sites, this enables unrestricted script execution against page state, including reading sensitive DOM data, manipulating forms, triggering privileged in-page actions, or bypassing higher-level safety constraints intended to limit the agent to predefined operations.

Context-Inappropriate Capability

High

• Confidence: 100% confidence
• Finding: The implementation uses eval to construct and run an async function from attacker-controlled script text, which is direct arbitrary code execution in the browser page context. This is especially dangerous because the rest of the skill already provides rich DOM primitives, so eval is unnecessary and materially expands the attack surface to anything accessible from the page environment.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill exposes an `executeJavascript(script)` method that directly evaluates attacker-controlled code with `eval` in the page context. That grants arbitrary script execution on any page where the skill is injected, far beyond the declared DOM inspection and interaction scope, enabling data theft, unauthorized actions, and bypass of higher-level safety controls.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: For a DOM manipulation skill, exposing raw script evaluation is unjustified because the file already provides dedicated methods for clicking, typing, selecting, scrolling, and reading DOM state. The extra capability turns a bounded browser automation tool into a general code-execution primitive inside arbitrary web origins, materially increasing abuse potential.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation text is broad enough to encourage use on arbitrary websites, which is risky for a skill designed to inject code into pages and simulate complex user interactions. Overbroad triggering increases the chance the skill is invoked in sensitive contexts where page injection could expose credentials, private content, or perform unintended actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs users to inject a 72KB controller into any web page without a clear warning about the security implications of executing code in arbitrary page contexts. Without prominent warnings, operators may use it on authenticated or sensitive sites, enabling data access, DOM tampering, and action simulation in contexts where trust boundaries matter.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This script connects to a Chrome DevTools Protocol endpoint and evaluates arbitrary JavaScript in the selected page context without any confirmation, origin restriction, or safety gating. In the context of a browser-operation skill, this makes DOM/script injection an intended capability, but it is still security-relevant because misuse of the script or a wrong target can execute untrusted code in a live browser session, potentially interacting with authenticated pages and sensitive data.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This script programmatically connects to a Chrome DevTools Protocol endpoint, enumerates targets, and executes arbitrary JavaScript in the selected page via Runtime.evaluate with no authentication, allowlisting, confirmation prompt, or safety checks. In the context of a browser-manipulation skill, that capability is inherently powerful: if the local CDP endpoint is exposed or a sensitive target ID is supplied, it can read/modify page state, interact with authenticated sessions, and exfiltrate data from any attached page.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: High-risk script execution is exposed as a normal method with no user-facing warning, confirmation, privilege separation, or runtime guardrails. In the context of a browser automation skill used across arbitrary web pages, that makes accidental or malicious misuse much more dangerous because an agent can silently execute arbitrary page code without an explicit trust decision by the user.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The code exposes arbitrary JavaScript execution without any user-facing warning, consent flow, or indication that the skill can run unrestricted code on visited pages. In this context, lack of disclosure is dangerous because users and calling agents may assume the skill is limited to safe DOM actions, while it can actually access page data, manipulate sessions, and perform hidden actions.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/page-controller-global.js:1956

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/page-controller.js:1956