ClawHub
Back to skill

Security audit

Browser Use Local

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed browser automation helper that can send browser-agent work to a configured external LLM, so users should treat page data as potentially shared with that provider.

Before installing, be comfortable with browser page content, screenshots, prompts, URLs, and session-derived context potentially being processed by the configured LLM provider. Avoid using it on internal, authenticated, regulated, or credential-heavy pages unless that data sharing is approved, and clear persistent browser sessions when they are no longer needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs users to configure an external LLM API key and send browser-agent workloads to a third-party service, but it provides no warning that prompts, page content, screenshots, extracted HTML, or other sensitive browsing data may be transmitted off-host. In a browser automation context, this omission is significant because users may unknowingly expose credentials, internal URLs, session data, or proprietary page contents to an external provider.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The hardcoded external endpoint points users to a third-party API service, creating a direct path for browser automation data to leave the local environment. Given this skill's purpose—capturing screenshots, extracting HTML, and running an agent over web content—the external transmission risk is real even if the endpoint itself is legitimate, because sensitive page data may be included in requests.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
Create `.env` (or export env vars) with:

- `OPENAI_API_KEY=...`
- `OPENAI_BASE_URL=https://api.moonshot.cn/v1`

Then run the bundled script:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This script instantiates an LLM client with a caller-controlled base URL and then runs a browser automation agent on a caller-controlled task without any user confirmation, allowlisting, or safety interstitial. In practice, that means the program can initiate external network calls and autonomous browsing actions immediately when executed, which is risky in environments where users may not realize the agent will contact third-party services or visit arbitrary sites specified through environment variables.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.