ClawHub
Back to skill

Security audit

Web Auto Form

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent form-automation purpose, but it gives an agent broad browser submission and file-upload power with under-scoped defaults that users should review before installing.

Install only if you are comfortable giving this skill broad browser-control authority. Prefer HTTPS-only workflows, avoid credentials and sensitive uploads unless you have verified the destination, disable failure diagnostics/debug artifacts for sensitive forms, and pin or review the actual Python package version before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned and Unverifiable Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–23
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

yaml
install:
  - spec: "pip install web-auto-form"
    type: pip
  - spec: "playwright install chromium"
    type: shell

Technical Analysis

The Skill instructs users to install web-auto-form from the default Python package index without specifying an exact version, package hash, lockfile, or trusted repository. It also downloads a Chromium build through Playwright without documenting an integrity-pinned browser revision.

The reviewed project contains only documentation and a JSON tool schema; it does not include the package implementation. Consequently, the implementation that receives form data, reads upload files, controls the browser, and performs network requests cannot be verified from this artifact. A future package update could materially change the effective behavior after the Skill has already passed review.

This is a supply-chain weakness rather than evidence that the current package is malicious. The risk arises because mutable external components execute with the invoking user's permissions and receive access to sensitive form content.

Attack Path

  1. An attacker compromises the package publisher account, distribution infrastructure, or an upstream dependency.
  2. The attacker publishes a modified release under the same package name.
  3. A user follows the documented installation instruction without a version or hash constraint.
  4. The package manager installs the attacker-controlled release.
  5. The package executes locally when the Skill is invoked.
  6. The compromised implementation can access form values, local files selected for upload, browser content, and network communications available to the process.

Impact Assessment

Exploitation would provide code execution under the account running the ...[truncated 458 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin web-auto-form to an exact, reviewed version.
  • Publish and use a lockfile containing all transitive dependencies.
  • Require cryptographic hashes during installation, such as through pip's --require-hashes mode.
  • Pin and verify the Playwright and Chromium revisions.
  • Include the executable implementation in the reviewed artifact or link it to a reproducible source commit.
  • Use a trusted private package registry or signed release artifacts where practical.
  • Run the dependency in a restricted environment with narrowly scoped filesystem and network access.
  • Establish automated dependency scanning and a controlled update-review process.

T09 · Insecure Skill Coding Practices

Warning
Location
web_auto_form_tool.json:7
Finding

Plaintext HTTP Permitted for Sensitive Form Submissions

Content
View full analysis

Vulnerability Details

File Location: web_auto_form_tool.json, lines 7–10; also documented in SKILL.md, line 79
Vulnerability Type: Plaintext transmission of potentially sensitive information
Risk Level: Medium

Vulnerable Code:

json
"url": {
  "type": "string",
  "description": "The starting URL to navigate to before executing steps. Must be a valid HTTPS or HTTP URL (HTTP triggers a security warning)."
}

Technical Analysis

The Skill is designed to submit names, email addresses, telephone numbers, uploaded resumes, and other potentially sensitive form data. However, its schema expressly permits ordinary HTTP destinations. The only documented mitigation is a warning.

HTTP does not provide transport confidentiality, server authentication, or integrity. A warning cannot prevent an on-path attacker from reading or modifying form submissions. PII redaction of logs and extraction output does not protect data transmitted from the browser to the destination server.

Network transmission is necessary for the declared form-automation functionality, but permitting plaintext transport for sensitive submissions exceeds the minimum safe privilege required. HTTPS should be mandatory except for narrowly defined local testing.

Attack Path

  1. A user or Agent supplies an HTTP URL as the starting destination or navigation target.
  2. The Skill accepts the URL because HTTP is allowed by the schema.
  3. The browser fills fields or selects a local file for upload.
  4. The user overlooks or accepts the security warning.
  5. The browser submits the form over plaintext HTTP.
  6. An attacker controlling a network intermediary captures or modifies the PII, uploaded file, response content, or submission destination.

A malicious HTTP page could also redirect the workflow or alter form markup so that sensitive values are submitted to a destination controlled by the attacker.

Impact Assessment

Exposed ...[truncated 430 chars]

Remediation
View remediation

Remediation Suggestions

  • Reject HTTP URLs by default at schema-validation and runtime levels.
  • Permit HTTP only for explicit loopback destinations used in local testing.
  • Require an interactive, destination-specific confirmation for any exceptional plaintext connection.
  • Prohibit PII, credentials, and file uploads whenever transport security is unavailable.
  • Revalidate the scheme and destination after every redirect.
  • Consider destination allowlists or per-origin approval for sensitive workflows.
  • Block link-local, cloud metadata, and private-network destinations unless explicitly authorized.
  • Apply the same HTTPS restrictions to starting URLs, navigate actions, remote upload sources, and redirects.

T09 · Insecure Skill Coding Practices

Warning
Location
web_auto_form_tool.json:236
Finding

Failure Diagnostics Capture Potentially Sensitive Page Content by Default

Content
View full analysis

Vulnerability Details

File Location: web_auto_form_tool.json, lines 236–243
Vulnerability Type: Excessive collection and propagation of sensitive diagnostic data
Risk Level: Medium

Vulnerable Code:

json
"sandbox": { "type": "boolean", "default": true, "description": "Force browser sandbox mode to prevent malicious page escape." },
"redact_pii": { "type": "boolean", "default": true, "description": "Global PII redaction switch. Applies to BOTH log output (value fields printed as <redacted>) AND extracted text (phone/email/ID replaced with ***). Can be overridden per-field via extract_schema.fields[].redact." },
"debug": { "type": "boolean", "default": false, "description": "When true: save page HTML and screenshot after each step, output full Playwright logs, keep browser open after completion." },
"debug_output_path": { "type": "string", "default": "./web_auto_form_debug_<timestamp>/", "description": "Directory for debug artifacts (HTML snapshots, screenshots, Playwright logs). Created automatically if it does not exist." },
"keep_open": { "type": "boolean", "default": false, "description": "Do not close browser after completion. Useful for manual inspection in debug mode." },
"upload_enforce_extension": { "type": "boolean", "default": false, "description": "When true, block upload if file_name extension does not match the detected MIME type. When false (default), warn but allow." },
"diagnose_on_failure": { "type": "boolean", "default": true, "description": "When true (default), automatically capture a screenshot and visible form elements when a step fails. Included inline in the results JSON so AI Agents can self-repair selector strategies without re-running." }

Technical Analysis

diagnose_on_failure is enabled by default and automatically captures a screenshot and visible form elements after a failed step. The captured information is then included inline in the result returned to t ...[truncated 2250 chars]

Remediation
View remediation

Remediation Suggestions

  • Change diagnose_on_failure to default to false.
  • Obtain explicit user consent before capturing screenshots, DOM content, or form-element values.
  • Return only minimal, sanitized failure metadata needed for selector repair.
  • Mask password fields, hidden inputs, tokens, cookies, authorization data, and populated form values before diagnostics leave the browser context.
  • Apply visual redaction to screenshots rather than relying only on text redaction.
  • Ensure diagnostic redaction cannot be disabled for credential and secret fields.
  • Store debug artifacts only in a restrictive directory with user-only permissions.
  • Define short retention periods and securely delete artifacts after troubleshooting.
  • Prevent debug artifacts from being included in Agent or model context unless separately approved.
  • Clearly identify which redaction controls apply to screenshots, DOM snapshots, traces, logs, and visible-element diagnostics.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The tool description and trigger guidance are broad enough to match generic browser-interaction requests, which can cause an agent to invoke this powerful automation skill when the user did not explicitly request form automation. Because the skill can navigate, fill, click, upload, extract data, and execute conditional logic, unintended invocation increases the chance of unauthorized web actions, data submission, or scraping on third-party sites.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The markdown specifies locale with a default value of "en-US", which imposes a specific language/locale behavior by default. Under the policy, locale constraints should either be user-selectable or clearly justified as region-specific; neither is stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest sets the browser locale default to "en-US," which imposes a specific language/locale behavior unless overridden. Because there is no accompanying opt-in, user choice, or justification that this skill is region-specific, this can violate locale-choice policy requirements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.