Grok Browser

Security checks across malware telemetry and agentic risk

Overview

This skill has a clear Grok automation purpose, but it asks the agent to control a normal Chrome profile through an external relay script and raw browser JavaScript, which deserves user review before installation.

Install only if you are comfortable letting an agent operate a real Chrome session for Grok. Use a dedicated Chrome profile with only the needed Grok account, verify the Browser Relay extension and attach script yourself, avoid keeping secrets on the clipboard, and confirm actions are targeting grok.com before sending prompts or clicking Copy.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to click Grok's Copy button and then read the system clipboard with `pbpaste` without any user warning or consent. Clipboard contents are a shared OS resource and may contain unrelated sensitive data; using it as part of the workflow can unexpectedly expose or overwrite secrets and creates a clear data-handling risk in this browser-automation context.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal