Browser Gemini Search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:46 AM UTC
• Version: 1.0.0

Overview

The skill is coherent and not malicious, but it gives browser automation access to the user's existing Chrome session and open tabs for a task that could be more tightly isolated.

Install only if you are comfortable letting the agent connect to your existing Chrome session. Close sensitive tabs first, use a dedicated Chrome profile if possible, and disable the remote debugging port after the task is done.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:2
• Finding: Excessive Access to the User's Primary Browser Session## Vulnerability Details **File Location**: `SKILL.md`, lines 2 and 10–20 **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium ### Vulnerable Code ```markdown description: Use Google Gemini (gemini.google.com) to search the web via OpenClaw's browser control. Activates when user asks to search something using Gemini, or wants to browse to Gemini. Uses the user's existing Chrome session via Chrome MCP (profile="user"). Prerequisites: (1) Chrome must be running with remote debugging enabled (--remote-debugging-port=9222), (2) user profile must be connected and approved when prompted. If browser is not connected, guide user to start Chrome with debugging port first. ## Workflow 1. **Ensure browser is connected** - Run `browser(action="start", profile="user", target="host")` - If `attachOnly` error or timeout: Chrome is not running with debugging port - Ask user to run: `& "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222` - Then retry connection 2. **Find or open Gemini tab** - Run `browser(action="tabs", profile="user", target="host")` to list open tabs - Look for existing Gemini tab (URL contains `gemini.google.com`) - If found: `browser(action="focus", targetId="<id>", profile="user", target="host")` - If not found: open new tab via `browser(action="navigate", url="https://gemini.google.com", target="host")` ``` ### Technical Analysis The skill instructs the agent to enable Chrome remote debugging, attach automation to the user's existing Chrome profile, and enumerate all open tabs. This violates least privilege because searching through Gemini does not require visibility into or control over unrelated tabs in the user's primary authenticated browser session. A remote-debugging connection may expose browser metadata and automation capabilities across the attached session. Although the documented workfl ...[truncated 1658 chars]
• Remediation: ## Remediation Suggestions 1. Use a dedicated, isolated Chrome profile for this skill rather than `profile="user"`. 2. Restrict the isolated profile to Gemini and avoid carrying cookies, extensions, history, or authenticated sessions from the user's primary profile. 3. Navigate directly to `https://gemini.google.com` instead of enumerating every open tab. 4. If attachment to an existing session is unavoidable, obtain explicit informed consent before connecting and clearly disclose that open-tab metadata may become visible. 5. Apply browser-tool allowlists that restrict navigation and interaction to `gemini.google.com` and required Google authentication endpoints. 6. Bind the debugging interface to localhost, prevent network exposure of port 9222, and terminate the debugging session when the task finishes. 7. Add safeguards that reject focus, snapshot, or interaction operations targeting non-Gemini tabs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation text uses broad phrases like searching or browsing to Gemini, which can cause the skill to trigger during ordinary browsing requests rather than only when the user explicitly intends browser automation against their live Chrome session. Because this skill attaches to the user's existing profile and can inspect tabs and page contents, overbroad activation increases the chance of unintended access to sensitive browsing context.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to attach to the user's existing Chrome session (`profile="user"`) and enumerate or focus tabs, but it does not clearly warn the user that active tabs, session state, and page contents may be exposed to the agent. This is dangerous because existing authenticated sessions and open pages can contain highly sensitive data, and the workflow explicitly lists tabs and reads page snapshots from the live browser context.

Static analysis

No suspicious patterns detected.