ClawHub
Back to skill

Security audit

Browser Control

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it advertises, but it exposes a remotely controllable browser and puts the VNC password inside links and persistent files.

Review before installing. This skill is not clearly malicious, but it handles a sensitive browser session and should only be used if you trust the publisher, the external verification service, ngrok, and the installer changes. Treat generated noVNC links as passwords, rotate the VNC password after use, stop the tunnel when finished, and avoid using it for high-value accounts unless the password-in-URL and sandbox issues are fixed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
start-tunnel.sh:148
Finding
Password-Bearing Remote-Control URL Is Persisted and Disclosed<![CDATA[ ## Vulnerability Details **File Location**: `start-tunnel.sh:148-191`; duplicated in generated code at `install.sh:476-519`; exposed by `status.sh:37-53` **Vulnerability Type**: Sensitive credential exposure through URLs, files, Agent workspace state, and command output **Risk Level**: High ### Complete Code Snippet ```bash # Build noVNC URL with auto-login password if [ -n "$VNC_PASSWORD" ] && [ "$VNC_PASSWORD" != "(your Mac password)" ]; then NOVNC_URL="${TUNNEL_URL}/vnc.html?password=${VNC_PASSWORD}&autoconnect=true" else NOVNC_URL="${TUNNEL_URL}/vnc.html?autoconnect=true" fi echo "" echo "=========================================" echo "✅ TUNNEL ACTIVE!" echo "" echo "🔗 Link: $NOVNC_URL" echo "🔐 Protected by: Google OAuth ($ALLOWED_EMAIL)" echo "" echo "Open from your phone or any browser!" echo "You'll need to login with your Google account." echo "=========================================" echo "" # Save to config.json cat > $CONFIG_FILE << CONF { "novncUrl": "$NOVNC_URL", "tunnelUrl": "$TUNNEL_URL", "allowedEmail": "$ALLOWED_EMAIL", "cdpUrl": "http://localhost:9222", "updatedAt": "$(date -Iseconds)" } CONF # Update TOOLS.md if [ -f "$TOOLS_FILE" ]; then # Remove old Browser Control section grep -v "## Browser Control" "$TOOLS_FILE" | grep -v "noVNC URL:" | grep -v "Protected by:" | grep -v "Send the link" | grep -v "When you need the user" | grep -v "Google OAuth" > "$TOOLS_FILE.tmp" || true mv "$TOOLS_FILE.tmp" "$TOOLS_FILE" fi cat >> "$TOOLS_FILE" << TOOLS ## Browser Control When you need the user to login, 2FA, captcha, or any manual verification: - noVNC URL: $NOVNC_URL - Protected by: Google OAuth ($ALLOWED_EMAIL) Send the link and wait for the user to say "done". The user will need to login with their Google account. TOOLS ``` The status script further discloses the stored value: ```bash # Get URL if available if [ -f "$SKILL_DIR/config.json" ]; then URL=$(jq -r '.novncUrl' "$SKILL_ ...[truncated 2417 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Do not include the VNC password in the URL. Present a password prompt only after the user passes OAuth. - Prefer a short-lived, single-use session capability rather than a reusable VNC password. - Create sensitive files under `umask 077` and explicitly apply `chmod 600` to `config.json`. - Do not write credentials or credential-bearing URLs into `TOOLS.md` or other persistent Agent context. - Make `status.sh` return only service state and a redacted endpoint, never the password-bearing URL or email unless explicitly requested. - Remove or securely overwrite stale session data when the tunnel stops. - Avoid printing secrets to terminal output and ensure application logs redact query parameters. - Rotate the VNC password for every tunnel session rather than once during installation. ]]>

T08 · Insecure Dependencies

Error
Location
install.sh:115
Finding
Dependencies Are Downloaded and Installed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:115-126` **Vulnerability Type**: Unpinned package installation and unchecked archive extraction **Risk Level**: High ### Complete Code Snippet ```bash # websockify via pip (not available on Homebrew) if ! command -v websockify &> /dev/null; then echo "📦 Installing websockify via pip..." pip3 install websockify || python3 -m pip install websockify fi # noVNC - download directly (not reliable on Homebrew) NOVNC_WEB="$SKILL_DIR/novnc" if [ ! -d "$NOVNC_WEB" ]; then echo "📦 Downloading noVNC..." curl -fsSL https://github.com/novnc/noVNC/archive/refs/tags/v1.4.0.tar.gz | tar -xz -C "$SKILL_DIR" mv "$SKILL_DIR/noVNC-1.4.0" "$NOVNC_WEB" fi ``` ### Technical Analysis The `websockify` package is installed from the active Python package index without a version constraint, lock file, signature, or hash. Consequently, the package resolved during a future installation can differ from the package reviewed today. The noVNC archive is version-tagged, but it is streamed directly from the network into `tar` without first verifying a cryptographic digest or release signature. HTTPS protects the transport channel but does not protect against a compromised upstream account, altered release artifact, certificate trust failure, or compromised hosting infrastructure. The Homebrew `curl | bash` expression at `install.sh:109` is only displayed as installation guidance and is not executed by this Skill. The confirmed executable retrieval is the noVNC archive pipeline, while the confirmed unpinned dependency action is the pip installation. ### Attack Path 1. An attacker compromises the package registry entry, upstream release, source-hosting account, DNS/TLS trust path, or another dependency-delivery component. 2. The user runs `install.sh`. 3. pip resolves an attacker-controlled `websockify` release, or curl retrieves an altered noVNC archive. 4. Package installation code executes during pip i ...[truncated 575 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Pin `websockify` to a reviewed exact version. - Install with a hash-locked requirements file, such as `pip install --require-hashes -r requirements.txt`. - Download the noVNC archive to a temporary file before extraction. - Verify a hardcoded SHA-256 digest or trusted release signature before using the archive. - Fail closed when verification fails; never continue with an unverified artifact. - Prefer trusted operating-system packages where available. - Use an isolated virtual environment instead of modifying the user's global Python environment. - Periodically review and deliberately update pinned versions rather than accepting automatic upstream changes. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
install.sh:85
Finding
Chromium Sandbox Is Disabled While Browsing Untrusted Websites<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:85-94` **Vulnerability Type**: Browser security boundary disabled **Risk Level**: High ### Complete Code Snippet ```bash # VNC startup script cat > ~/.vnc/xstartup << 'XSTARTUP' #!/bin/bash xrdb $HOME/.Xresources 2>/dev/null startxfce4 & sleep 3 # Start Chromium with remote debugging chromium-browser --no-sandbox --disable-gpu --remote-debugging-port=9222 2>/dev/null & XSTARTUP chmod +x ~/.vnc/xstartup ``` ### Technical Analysis The generated Linux VNC startup script launches Chromium with `--no-sandbox`. The browser sandbox is a major containment boundary intended to limit what a compromised renderer process can access. This Skill is explicitly designed for login, CAPTCHA, MFA, and arbitrary manual browsing, so Chromium is expected to process untrusted and potentially hostile website content. Disabling the sandbox is not necessary for a normal unprivileged VNC desktop and materially increases the consequences of a browser vulnerability. The simultaneous DevTools endpoint on port 9222 also grants local processes extensive control over the browser, although local CDP access itself is part of the declared workflow. ### Attack Path 1. The user starts the VNC browser created by the installer. 2. The user or Agent navigates Chromium to a malicious or compromised website. 3. The website exploits a renderer or browser vulnerability. 4. Because Chromium was launched without its sandbox, the exploit has fewer containment boundaries to escape. 5. Attacker code accesses resources available to the account running Chromium, potentially including browser data, files, and local services. ### Impact Assessment The impact can include execution with the privileges of the user running Chromium, theft or modification of browser-session data, access to user-readable files, and interaction with local services. This does not directly grant root privileges, but it substantially enlarges the scope of a successful ...[truncated 23 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Remove `--no-sandbox` from the Chromium command line. - Run Chromium as a dedicated, non-privileged account rather than as root or a broadly privileged user. - Use a separate temporary browser profile for each remote-control session. - Apply additional operating-system confinement such as AppArmor, SELinux, or a properly configured container. - Restrict access to CDP port 9222 to the required local process and avoid exposing it on non-loopback interfaces. - Keep Chromium patched and block startup if a supported sandbox cannot be initialized. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
stop-tunnel.sh:1
Finding
Broad Process-Matching Commands Can Terminate Unrelated Services<![CDATA[ ## Vulnerability Details **File Location**: `stop-tunnel.sh:1-9`; also used by `start-tunnel.sh:81-84,113-117` and generated in `install.sh` **Vulnerability Type**: Unsafe process management and denial of service **Risk Level**: Medium ### Complete Code Snippet ```bash #!/bin/bash echo "🛑 Stopping Browser Control services..." pkill -f "ngrok.*http" 2>/dev/null && echo " ✓ ngrok stopped" || echo " - ngrok not running" pkill -f "websockify.*6080" 2>/dev/null && echo " ✓ noVNC stopped" || echo " - noVNC not running" if [[ "$OSTYPE" == "linux-gnu"* ]]; then vncserver -kill :1 2>/dev/null && echo " ✓ VNC stopped" || echo " - VNC not running" fi ``` The start script uses the same broad termination method: ```bash # Kill any existing ngrok pkill -f "ngrok.*http" 2>/dev/null || true sleep 1 ``` ### Technical Analysis `pkill -f` compares the regular expression against complete command lines. The expressions are not tied to the PID launched by this Skill, a unique configuration path, or an executable identity. Any same-user process whose command line contains matching terms can be terminated. The Skill records the ngrok PID in `ngrok.pid`, but the stop script does not read or validate that PID. The websockify PID is not persisted for controlled shutdown. ### Attack Path 1. Another legitimate ngrok tunnel or websockify service is running under the same account with a matching command line. 2. The user starts or stops this Skill. 3. `pkill -f` matches both the Skill's process and the unrelated process. 4. The unrelated tunnel or service is terminated. 5. Applications relying on that process lose connectivity or availability. A local actor able to create a process with a matching command line could also cause the script to target that process, although the primary confirmed risk is collateral termination of legitimate services. ### Impact Assessment The direct impact is denial of service for unrelated ngrok tunnels or websockify insta ...[truncated 212 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Persist the exact PIDs of both ngrok and websockify in files created with restrictive permissions. - Before signaling a recorded PID, verify that it is still owned by the current user and that its executable and arguments match the expected Skill process. - Use `kill -- "$PID"` instead of command-line-wide `pkill -f` matching. - Remove stale PID files after confirmed termination. - Consider supervising child processes through a dedicated process manager or retaining the parent process so child PIDs can be managed directly. - Do not kill pre-existing services during startup; instead, fail with a clear port-conflict message. ]]>

other

Warning
Location
install.sh:226
Finding
External Verification Service Controls the OAuth Email Allowlist<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:226-274` **Vulnerability Type**: External identity-verification trust boundary **Risk Level**: Medium ### Complete Code Snippet ```python #!/usr/bin/env python3 import json, sys, urllib.request VERIFY_URL = "https://browser-control-auth.vercel.app" # Use /dev/tty for interactive I/O try: tty = open('/dev/tty', 'w') except: tty = sys.stdout def tty_print(msg=""): tty.write(msg + "\n") tty.flush() def read_input(prompt): tty.write(prompt) tty.flush() try: with open('/dev/tty', 'r') as tty_in: return tty_in.readline().strip() except: return input().strip() tty_print("") tty_print("1. Open this link in your browser:") tty_print("") tty_print(f" 👉 {VERIFY_URL}/verify") tty_print("") tty_print("2. Sign in with Google") tty_print("3. Copy the 6-character code") tty_print("") code = read_input("Enter code: ").upper() if len(code) != 6: tty_print("❌ Invalid code (should be 6 characters)") sys.exit(1) try: url = f"{VERIFY_URL}/api/verify?code={code}" req = urllib.request.Request(url, method="GET") req.add_header("Accept", "application/json") with urllib.request.urlopen(req, timeout=30) as response: data = json.loads(response.read().decode()) if "email" not in data: tty_print(f"❌ Invalid response: {data}") sys.exit(1) email = data["email"] tty_print("") tty_print(f"✅ Verified: {email}") tty_print("") # Output email to stdout for capture print(f"GOOGLE_EMAIL={email}") except urllib.error.HTTPError as e: tty_print("❌ Invalid or expired code" if e.code == 404 else f"❌ Error: {e.code} {e.reason}") sys.exit(1) except Exception as e: tty_print(f"❌ Error: {e}") sys.exit(1) ``` ### Technical Analysis The installer trusts an externally hosted Vercel application to convert a six-character code into the Google email addr ...[truncated 1683 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Perform the OAuth flow locally or rely directly on ngrok's documented identity and allowlist configuration. - If an external broker is unavoidable, use a signed response containing the email, transaction identifier, audience, issuer, and short expiration time. - Pin and verify the signing key locally rather than trusting an unsigned JSON response. - Bind each verification response to a cryptographically random, installer-generated nonce. - Require the user to explicitly confirm the resulting allowlisted email before saving it. - Provide documentation identifying the operator, source code, privacy behavior, and security model of the external verification service. - Allow advanced users to enter and independently verify their intended OAuth email without using the third-party broker. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (31)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documentation claims strong protections and a complete remote-login workflow, but the finding indicates those controls are not actually implemented. This creates a dangerous trust gap: operators may expose a browser session or debugging interface believing Google OAuth/email restriction exists when it does not, leading to unauthorized access or session hijacking.

Chaining Abuse

High
Category
Tool Misuse
Content
# Chromium
    echo "📦 Installing Chromium..."
    sudo apt-get install -y chromium-browser || sudo apt-get install -y chromium
    
    # ngrok
    if ! command -v ngrok &> /dev/null; then
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High
Category
Tool Misuse
Content
# ngrok
    if ! command -v ngrok &> /dev/null; then
        echo "📦 Installing ngrok ($ARCH)..."
        curl -s https://ngrok-agent.s3.amazonaws.com/ngrok.asc | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null
        echo "deb https://ngrok-agent.s3.amazonaws.com buster main" | sudo tee /etc/apt/sources.list.d/ngrok.list
        sudo apt-get update
        sudo apt-get install -y ngrok
Confidence
90% confidence
Finding
The script chains a network download directly into sudo tee to place trust material into the system APT trust store. This pattern is dangerous because it collapses retrieval, validation, and privileged installation into one step, increasing the blast radius of MITM, DNS, or vendor compromise into system-level package trust compromise.

Chaining Abuse

High
Category
Tool Misuse
Content
if ! command -v ngrok &> /dev/null; then
        echo "📦 Installing ngrok ($ARCH)..."
        curl -s https://ngrok-agent.s3.amazonaws.com/ngrok.asc | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null
        echo "deb https://ngrok-agent.s3.amazonaws.com buster main" | sudo tee /etc/apt/sources.list.d/ngrok.list
        sudo apt-get update
        sudo apt-get install -y ngrok
    fi
Confidence
75% confidence
Finding
Piping repository configuration text directly into sudo tee modifies privileged package manager configuration without review or validation. While less severe than the key import itself, it still facilitates supply-chain expansion in a single privileged step and makes accidental or malicious repository substitution easier.

Missing User Warnings

High
Confidence
97% confidence
Finding
The start script appends the VNC password directly into the noVNC URL query string and prints that link for sharing. URLs are commonly logged in shell history, chat transcripts, browser history, screenshots, reverse proxies, and analytics, so anyone obtaining the link may gain immediate session access if they can also satisfy or bypass the outer access control.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The script embeds the VNC password directly into the generated noVNC URL as a query parameter. URLs are commonly exposed through shell history, logs, browser history, screenshots, chat transcripts, referrer leakage, and copied documentation, so anyone who obtains the link may gain desktop access once OAuth is satisfied or if the link is reused in an unintended context.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises and instructs use of shell, file, and network-capable operations but declares no explicit tool scope or permission boundaries. In a skill that launches tunnels, reads local config, and exposes remote browser access, missing scope declarations weakens policy enforcement and can enable overbroad execution beyond what users expect.

Vague Triggers

Medium
Confidence
95% confidence
Finding
This manifest description can match a wide range of ordinary browser-related requests, making it unclear when the skill should activate versus when normal browser use would suffice. The file does not provide negative examples or tighter constraints to prevent unintended invocation.

Vague Triggers

Medium
Confidence
97% confidence
Finding
This phrase overlaps with many common browsing tasks and does not define boundaries for when the skill should or should not be used. Without explicit constraints, an agent could invoke the remote browser workflow for routine actions unnecessarily.

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The skill states there is 'no password to leak' while instructing users to share a URL that embeds the VNC password. Anyone who obtains that link through chat history, logs, screenshots, browser history, or referrers may gain remote access, and the misleading wording increases the chance the secret is handled carelessly.

Session Persistence

Medium
Category
Rogue Agent
Content
echo ""

#######################################
# CREATE DIRECTORIES
#######################################

mkdir -p ~/.openclaw/skills/browser-control
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
VNC_PASSWORD=$(openssl rand -base64 6)
echo "$VNC_PASSWORD" > $SKILL_DIR/vnc-password
chmod 600 $SKILL_DIR/vnc-password

#######################################
# LINUX INSTALLATION
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
VNC_PASSWORD=$(openssl rand -base64 6)
echo "$VNC_PASSWORD" > $SKILL_DIR/vnc-password
chmod 600 $SKILL_DIR/vnc-password

#######################################
# LINUX INSTALLATION
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
VNC_PASSWORD=$(openssl rand -base64 6)
echo "$VNC_PASSWORD" > $SKILL_DIR/vnc-password
chmod 600 $SKILL_DIR/vnc-password

#######################################
# LINUX INSTALLATION
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if [[ "$OS" == "linux" ]]; then
    echo "📦 Installing dependencies (Linux)..."
    
    sudo apt-get update
    sudo apt-get install -y tightvncserver xfce4 xfce4-terminal xterm novnc websockify curl jq
    
    # Chromium
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if [[ "$OS" == "linux" ]]; then
    echo "📦 Installing dependencies (Linux)..."
    
    sudo apt-get update
    sudo apt-get install -y tightvncserver xfce4 xfce4-terminal xterm novnc websockify curl jq
    
    # Chromium
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if [[ "$OS" == "linux" ]]; then
    echo "📦 Installing dependencies (Linux)..."
    
    sudo apt-get update
    sudo apt-get install -y tightvncserver xfce4 xfce4-terminal xterm novnc websockify curl jq
    
    # Chromium
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if [[ "$OS" == "linux" ]]; then
    echo "📦 Installing dependencies (Linux)..."
    
    sudo apt-get update
    sudo apt-get install -y tightvncserver xfce4 xfce4-terminal xterm novnc websockify curl jq
    
    # Chromium
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if [[ "$OS" == "linux" ]]; then
    echo "📦 Installing dependencies (Linux)..."
    
    sudo apt-get update
    sudo apt-get install -y tightvncserver xfce4 xfce4-terminal xterm novnc websockify curl jq
    
    # Chromium
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if [[ "$OS" == "linux" ]]; then
    echo "📦 Installing dependencies (Linux)..."
    
    sudo apt-get update
    sudo apt-get install -y tightvncserver xfce4 xfce4-terminal xterm novnc websockify curl jq
    
    # Chromium
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# ngrok
    if ! command -v ngrok &> /dev/null; then
        echo "📦 Installing ngrok ($ARCH)..."
        curl -s https://ngrok-agent.s3.amazonaws.com/ngrok.asc | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null
        echo "deb https://ngrok-agent.s3.amazonaws.com buster main" | sudo tee /etc/apt/sources.list.d/ngrok.list
        sudo apt-get update
        sudo apt-get install -y ngrok
Confidence
86% confidence
Finding
The script downloads repository trust material from the network and pipes it into sudo tee to install it as a trusted key. If the source is compromised or tampered with, this can grant trust to malicious packages and convert a network or supply-chain attack into privileged code execution on the host.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if ! command -v ngrok &> /dev/null; then
        echo "📦 Installing ngrok ($ARCH)..."
        curl -s https://ngrok-agent.s3.amazonaws.com/ngrok.asc | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null
        echo "deb https://ngrok-agent.s3.amazonaws.com buster main" | sudo tee /etc/apt/sources.list.d/ngrok.list
        sudo apt-get update
        sudo apt-get install -y ngrok
    fi
Confidence
82% confidence
Finding
Writing a new apt source list entry with sudo adds a third-party package repository to the system. This permanently expands the system trust boundary and enables privileged package installation from that external source, which is risky in a security-sensitive skill handling browser sessions and credentials.

Session Persistence

Medium
Category
Rogue Agent
Content
# Configure VNC
    echo "🔧 Configuring VNC..."
    mkdir -p ~/.vnc
    echo "$VNC_PASSWORD" | vncpasswd -f > ~/.vnc/passwd
    chmod 600 ~/.vnc/passwd
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The installer launches Chromium with --remote-debugging-port=9222 while the skill is described as human-only remote browser assistance. Chrome DevTools Protocol access can be used to inspect pages, cookies, local storage, and automate browser actions, materially expanding the capability beyond manual VNC access and increasing the chance of credential/session abuse during login and 2FA flows.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The installer sends a user-provided verification code to an external service at browser-control-auth.vercel.app, which returns the verified email used for access control. Although not necessarily malicious, this outsources identity verification and discloses user identity linkage to a third party without clear upfront disclosure of the external service, its trust boundary, retention, or privacy implications.