Security audit

Browser Control

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it advertises, but it exposes a remotely controllable browser and puts the VNC password inside links and persistent files.

Review before installing. This skill is not clearly malicious, but it handles a sensitive browser session and should only be used if you trust the publisher, the external verification service, ngrok, and the installer changes. Treat generated noVNC links as passwords, rotate the VNC password after use, stop the tunnel when finished, and avoid using it for high-value accounts unless the password-in-URL and sandbox issues are fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: start-tunnel.sh:148
Finding: Password-Bearing Remote-Control URL Is Persisted and Disclosed
Content: View full analysis
$CONFIG_FILE << CONF { "novncUrl": "$NOVNC_URL", "tunnelUrl": "$TUNNEL_URL", "allowedEmail": "$ALLOWED_EMAIL", "cdpUrl": "http://localhost:9222", "updatedAt": "$(date -Iseconds)" } CONF # Update TOOLS.md if [ -f "$TOOLS_FILE" ]; then # Remove old Browser Control section grep -v "## Browser Control" "$TOOLS_FILE" | grep -v "noVNC URL:" | grep -v "Protected by:" | grep -v "Send the link" | grep -v "When you need the user" | grep -v "Google OAuth" > "$TOOLS_FILE.tmp" || true mv "$TOOLS_FILE.tmp" "$TOOLS_FILE" fi cat >> "$TOOLS_FILE" << TOOLS ## Browser Control When you need the user to login, 2FA, captcha, or any manual verification: - noVNC URL: $NOVNC_URL - Protected by: Google OAuth ($ALLOWED_EMAIL) Send the link and wait for the user to say "done". The user will need to login with their Google account. TOOLS ``` The status script further discloses the stored value: ```bash # Get URL if available if [ -f "$SKILL_DIR/config.json" ]; then URL=$(jq -r '.novncUrl' "$SKILL_ ...[truncated 2417 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: install.sh:115
Finding: Dependencies Are Downloaded and Installed Without Integrity Verification
Content: View full analysis
/dev/null; then echo "📦 Installing websockify via pip..." pip3 install websockify || python3 -m pip install websockify fi # noVNC - download directly (not reliable on Homebrew) NOVNC_WEB="$SKILL_DIR/novnc" if [ ! -d "$NOVNC_WEB" ]; then echo "📦 Downloading noVNC..." curl -fsSL https://github.com/novnc/noVNC/archive/refs/tags/v1.4.0.tar.gz | tar -xz -C "$SKILL_DIR" mv "$SKILL_DIR/noVNC-1.4.0" "$NOVNC_WEB" fi ``` ### Technical Analysis The `websockify` package is installed from the active Python package index without a version constraint, lock file, signature, or hash. Consequently, the package resolved during a future installation can differ from the package reviewed today. The noVNC archive is version-tagged, but it is streamed directly from the network into `tar` without first verifying a cryptographic digest or release signature. HTTPS protects the transport channel but does not protect against a compromised upstream account, altered release artifact, certificate trust failure, or compromised hosting infrastructure. The Homebrew `curl | bash` expression at `install.sh:109` is only displayed as installation guidance and is not executed by this Skill. The confirmed executable retrieval is the noVNC archive pipeline, while the confirmed unpinned dependency action is the pip installation. ### Attack Path 1. An attacker compromises the package registry entry, upstream release, source-hosting account, DNS/TLS trust path, or another dependency-delivery component. 2. The user runs `install.sh`. 3. pip resolves an attacker-controlled `websockify` release, or curl retrieves an altered noVNC archive. 4. Package installation code executes during pip i ...[truncated 575 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: install.sh:85
Finding: Chromium Sandbox Is Disabled While Browsing Untrusted Websites
Content: View full analysis
~/.vnc/xstartup << 'XSTARTUP' #!/bin/bash xrdb $HOME/.Xresources 2>/dev/null startxfce4 & sleep 3 # Start Chromium with remote debugging chromium-browser --no-sandbox --disable-gpu --remote-debugging-port=9222 2>/dev/null & XSTARTUP chmod +x ~/.vnc/xstartup ``` ### Technical Analysis The generated Linux VNC startup script launches Chromium with `--no-sandbox`. The browser sandbox is a major containment boundary intended to limit what a compromised renderer process can access. This Skill is explicitly designed for login, CAPTCHA, MFA, and arbitrary manual browsing, so Chromium is expected to process untrusted and potentially hostile website content. Disabling the sandbox is not necessary for a normal unprivileged VNC desktop and materially increases the consequences of a browser vulnerability. The simultaneous DevTools endpoint on port 9222 also grants local processes extensive control over the browser, although local CDP access itself is part of the declared workflow. ### Attack Path 1. The user starts the VNC browser created by the installer. 2. The user or Agent navigates Chromium to a malicious or compromised website. 3. The website exploits a renderer or browser vulnerability. 4. Because Chromium was launched without its sandbox, the exploit has fewer containment boundaries to escape. 5. Attacker code accesses resources available to the account running Chromium, potentially including browser data, files, and local services. ### Impact Assessment The impact can include execution with the privileges of the user running Chromium, theft or modification of browser-session data, access to user-readable files, and interaction with local services. This does not directly grant root privileges, but it substantially enlarges the scope of a successful ...[truncated 23 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: stop-tunnel.sh:1
Finding: Broad Process-Matching Commands Can Terminate Unrelated Services
Content: View full analysis
/dev/null && echo " ✓ ngrok stopped" || echo " - ngrok not running" pkill -f "websockify.*6080" 2>/dev/null && echo " ✓ noVNC stopped" || echo " - noVNC not running" if [[ "$OSTYPE" == "linux-gnu"* ]]; then vncserver -kill :1 2>/dev/null && echo " ✓ VNC stopped" || echo " - VNC not running" fi ``` The start script uses the same broad termination method: ```bash # Kill any existing ngrok pkill -f "ngrok.*http" 2>/dev/null || true sleep 1 ``` ### Technical Analysis `pkill -f` compares the regular expression against complete command lines. The expressions are not tied to the PID launched by this Skill, a unique configuration path, or an executable identity. Any same-user process whose command line contains matching terms can be terminated. The Skill records the ngrok PID in `ngrok.pid`, but the stop script does not read or validate that PID. The websockify PID is not persisted for controlled shutdown. ### Attack Path 1. Another legitimate ngrok tunnel or websockify service is running under the same account with a matching command line. 2. The user starts or stops this Skill. 3. `pkill -f` matches both the Skill's process and the unrelated process. 4. The unrelated tunnel or service is terminated. 5. Applications relying on that process lose connectivity or availability. A local actor able to create a process with a matching command line could also cause the script to target that process, although the primary confirmed risk is collateral termination of legitimate services. ### Impact Assessment The direct impact is denial of service for unrelated ngrok tunnels or websockify insta ...[truncated 212 chars]
Remediation: View remediation

other

Warning

Location: install.sh:226
Finding: External Verification Service Controls the OAuth Email Allowlist
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (31)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation claims strong protections and a complete remote-login workflow, but the finding indicates those controls are not actually implemented. This creates a dangerous trust gap: operators may expose a browser session or debugging interface believing Google OAuth/email restriction exists when it does not, leading to unauthorized access or session hijacking.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · install.sh (reported line 68)May include surrounding context.
sh
# Chromium echo "📦 Installing Chromium..." sudo apt-get install -y chromium-browser || sudo apt-get install -y chromium # ngrok if ! command -v ngrok &> /dev/null; then

Chaining Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The script chains a network download directly into sudo tee to place trust material into the system APT trust store. This pattern is dangerous because it collapses retrieval, validation, and privileged installation into one step, increasing the blast radius of MITM, DNS, or vendor compromise into system-level package trust compromise.
Content: Scanner excerpt · install.sh (reported line 73)May include surrounding context.
sh
# ngrok if ! command -v ngrok &> /dev/null; then echo "📦 Installing ngrok ($ARCH)..." curl -s https://ngrok-agent.s3.amazonaws.com/ngrok.asc | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null echo "deb https://ngrok-agent.s3.amazonaws.com buster main" | sudo tee /etc/apt/sources.list.d/ngrok.list sudo apt-get update sudo apt-get install -y ngrok

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Piping repository configuration text directly into sudo tee modifies privileged package manager configuration without review or validation. While less severe than the key import itself, it still facilitates supply-chain expansion in a single privileged step and makes accidental or malicious repository substitution easier.
Content: Scanner excerpt · install.sh (reported line 74)May include surrounding context.
sh
if ! command -v ngrok &> /dev/null; then echo "📦 Installing ngrok ($ARCH)..." curl -s https://ngrok-agent.s3.amazonaws.com/ngrok.asc | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null echo "deb https://ngrok-agent.s3.amazonaws.com buster main" | sudo tee /etc/apt/sources.list.d/ngrok.list sudo apt-get update sudo apt-get install -y ngrok fi

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The start script appends the VNC password directly into the noVNC URL query string and prints that link for sharing. URLs are commonly logged in shell history, chat transcripts, browser history, screenshots, reverse proxies, and analytics, so anyone obtaining the link may gain immediate session access if they can also satisfy or bypass the outer access control.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script embeds the VNC password directly into the generated noVNC URL as a query parameter. URLs are commonly exposed through shell history, logs, browser history, screenshots, chat transcripts, referrer leakage, and copied documentation, so anyone who obtains the link may gain desktop access once OAuth is satisfied or if the link is reused in an unintended context.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises and instructs use of shell, file, and network-capable operations but declares no explicit tool scope or permission boundaries. In a skill that launches tunnels, reads local config, and exposes remote browser access, missing scope declarations weakens policy enforcement and can enable overbroad execution beyond what users expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This manifest description can match a wide range of ordinary browser-related requests, making it unclear when the skill should activate versus when normal browser use would suffice. The file does not provide negative examples or tighter constraints to prevent unintended invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This phrase overlaps with many common browsing tasks and does not define boundaries for when the skill should or should not be used. Without explicit constraints, an agent could invoke the remote browser workflow for routine actions unnecessarily.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill states there is 'no password to leak' while instructing users to share a URL that embeds the VNC password. Anyone who obtains that link through chat history, logs, screenshots, browser history, or referrers may gain remote access, and the misleading wording increases the chance the secret is handled carelessly.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 41)May include surrounding context.
sh
echo "" ####################################### # CREATE DIRECTORIES ####################################### mkdir -p ~/.openclaw/skills/browser-control

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install.sh (reported line 54)May include surrounding context.
sh
VNC_PASSWORD=$(openssl rand -base64 6) echo "$VNC_PASSWORD" > $SKILL_DIR/vnc-password chmod 600 $SKILL_DIR/vnc-password ####################################### # LINUX INSTALLATION

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install.sh (reported line 83)May include surrounding context.
sh
VNC_PASSWORD=$(openssl rand -base64 6) echo "$VNC_PASSWORD" > $SKILL_DIR/vnc-password chmod 600 $SKILL_DIR/vnc-password ####################################### # LINUX INSTALLATION

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install.sh (reported line 317)May include surrounding context.
sh
VNC_PASSWORD=$(openssl rand -base64 6) echo "$VNC_PASSWORD" > $SKILL_DIR/vnc-password chmod 600 $SKILL_DIR/vnc-password ####################################### # LINUX INSTALLATION

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install.sh (reported line 63)May include surrounding context.
sh
if [[ "$OS" == "linux" ]]; then echo "📦 Installing dependencies (Linux)..." sudo apt-get update sudo apt-get install -y tightvncserver xfce4 xfce4-terminal xterm novnc websockify curl jq # Chromium

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install.sh (reported line 64)May include surrounding context.
sh
if [[ "$OS" == "linux" ]]; then echo "📦 Installing dependencies (Linux)..." sudo apt-get update sudo apt-get install -y tightvncserver xfce4 xfce4-terminal xterm novnc websockify curl jq # Chromium

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install.sh (reported line 68)May include surrounding context.
sh
if [[ "$OS" == "linux" ]]; then echo "📦 Installing dependencies (Linux)..." sudo apt-get update sudo apt-get install -y tightvncserver xfce4 xfce4-terminal xterm novnc websockify curl jq # Chromium

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install.sh (reported line 75)May include surrounding context.
sh
if [[ "$OS" == "linux" ]]; then echo "📦 Installing dependencies (Linux)..." sudo apt-get update sudo apt-get install -y tightvncserver xfce4 xfce4-terminal xterm novnc websockify curl jq # Chromium

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install.sh (reported line 76)May include surrounding context.
sh
if [[ "$OS" == "linux" ]]; then echo "📦 Installing dependencies (Linux)..." sudo apt-get update sudo apt-get install -y tightvncserver xfce4 xfce4-terminal xterm novnc websockify curl jq # Chromium

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install.sh (reported line 218)May include surrounding context.
sh
if [[ "$OS" == "linux" ]]; then echo "📦 Installing dependencies (Linux)..." sudo apt-get update sudo apt-get install -y tightvncserver xfce4 xfce4-terminal xterm novnc websockify curl jq # Chromium

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 86% confidence
Finding: The script downloads repository trust material from the network and pipes it into sudo tee to install it as a trusted key. If the source is compromised or tampered with, this can grant trust to malicious packages and convert a network or supply-chain attack into privileged code execution on the host.
Content: Scanner excerpt · install.sh (reported line 73)May include surrounding context.
sh
# ngrok if ! command -v ngrok &> /dev/null; then echo "📦 Installing ngrok ($ARCH)..." curl -s https://ngrok-agent.s3.amazonaws.com/ngrok.asc | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null echo "deb https://ngrok-agent.s3.amazonaws.com buster main" | sudo tee /etc/apt/sources.list.d/ngrok.list sudo apt-get update sudo apt-get install -y ngrok

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 82% confidence
Finding: Writing a new apt source list entry with sudo adds a third-party package repository to the system. This permanently expands the system trust boundary and enables privileged package installation from that external source, which is risky in a security-sensitive skill handling browser sessions and credentials.
Content: Scanner excerpt · install.sh (reported line 74)May include surrounding context.
sh
if ! command -v ngrok &> /dev/null; then echo "📦 Installing ngrok ($ARCH)..." curl -s https://ngrok-agent.s3.amazonaws.com/ngrok.asc | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null echo "deb https://ngrok-agent.s3.amazonaws.com buster main" | sudo tee /etc/apt/sources.list.d/ngrok.list sudo apt-get update sudo apt-get install -y ngrok fi

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 81)May include surrounding context.
sh
# Configure VNC echo "🔧 Configuring VNC..." mkdir -p ~/.vnc echo "$VNC_PASSWORD" | vncpasswd -f > ~/.vnc/passwd chmod 600 ~/.vnc/passwd

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The installer launches Chromium with --remote-debugging-port=9222 while the skill is described as human-only remote browser assistance. Chrome DevTools Protocol access can be used to inspect pages, cookies, local storage, and automate browser actions, materially expanding the capability beyond manual VNC access and increasing the chance of credential/session abuse during login and 2FA flows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The installer sends a user-provided verification code to an external service at browser-control-auth.vercel.app, which returns the verified email used for access control. Although not necessarily malicious, this outsources identity verification and discloses user identity linkage to a third party without clear upfront disclosure of the external service, its trust boundary, retention, or privacy implications.
Content: No source excerpt is available for this finding.