ClawHub
Back to skill

Security audit

Use My Browser

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent browser-automation skill, but it gives broad agent control inside logged-in Chrome sessions through unpinned browser-control components without clear approval limits.

Install only if you are comfortable giving the agent broad control over pages open in your logged-in Chrome session. Prefer using a separate browser profile with limited logins, review or pin the Tampermonkey userscript and plugin versions before setup, and avoid using this skill on banking, identity, healthcare, admin, or other high-risk sites unless every action is explicitly directed by you.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:15
Finding

Mutable Remote Tampermonkey Payload Installed into the User's Browser

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–21
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

markdown
## Setup

```bash
openclaw plugins install openclaw-tmwd --registry https://registry.npmjs.org

Then install the Tampermonkey userscript in Chrome. Green indicator at bottom-right = connected.

text

### Technical Analysis

The Skill directs the user to install a Tampermonkey userscript from the mutable `main` branch of an external personal GitHub repository. The effective browser-executed code is not included in the audited project, pinned to an immutable commit, or protected by a documented cryptographic integrity check.

Consequently, the behavior reviewed during one audit can differ from the code later downloaded and executed by users. Tampermonkey userscripts can operate inside matched browser pages, and this Skill is specifically designed to interact with authenticated browsing sessions. Compromise of the repository, maintainer account, distribution URL, or update process could therefore replace the browser-control component with attacker-controlled JavaScript.

### Attack Path

1. An attacker compromises the external GitHub repository, its maintainer account, or the userscript distribution process.
2. The attacker modifies `assets/ljq_web_driver.user.js` on the referenced `main` branch.
3. A user installs or updates the userscript through the documented raw GitHub URL.
4. Tampermonkey executes the modified payload in browser pages covered by its configured origin permissions.
5. The payload reads page contents or browser-accessible session data, manipulates authenticated workflows, or transmits captured information to an attacker-controlled endpoint.

### Impact Assessment

Exploitation could expose authenticated page content, lo
...[truncated 397 chars]
Remediation
View remediation

Remediation Suggestions

  • Vendor the reviewed userscript source into the Skill package so its effective behavior is included in security review.
  • If external hosting is unavoidable, reference an immutable commit rather than a mutable branch.
  • Publish and verify a cryptographic digest or signature before installation and update.
  • Disable automatic updates unless every release is reviewed and integrity-verified.
  • Minimize Tampermonkey metadata permissions, including @match, @include, @connect, and privileged APIs.
  • Use an explicit allowlist of approved origins and exclude financial, identity, administrative, and other high-risk sites by default.
  • Document the exact reviewed version and provide a reproducible build and release process.

T08 · Insecure Dependencies

Error
Location
SKILL.md:18
Finding

Unpinned Third-Party Browser-Control Plugin Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 18
Vulnerability Type: Insecure dependency installation
Risk Level: High

Vulnerable Code:

bash
openclaw plugins install openclaw-tmwd --registry https://registry.npmjs.org

Technical Analysis

The setup command installs openclaw-tmwd without specifying an exact package version or integrity digest. Installation can therefore resolve to a future package release whose implementation differs from the version that was originally reviewed.

The plugin's source is not present in this project, and the project has no lockfile or integrity metadata that would make dependency resolution reproducible. Because this component provides the bridge between the Agent and the user's real browser, compromise of the package publisher, registry account, or a future release could introduce code with access to both the local Agent environment and browser-control channel.

Attack Path

  1. An attacker compromises the package publisher account or causes a malicious future release of openclaw-tmwd to be published.
  2. A user follows the documented command after the malicious release becomes the version selected by the registry.
  3. The installation process retrieves and installs the attacker-controlled package.
  4. The plugin executes with the permissions available to the OpenClaw process.
  5. The malicious plugin abuses local process access, intercepts browser commands or results, or controls the connected browser bridge.

Impact Assessment

A compromised plugin could execute code with the OpenClaw process's operating-system privileges. It could potentially access local files available to that process, observe Agent data, intercept sensitive browser content, modify browser automation commands, or take control of authenticated browsing operations. The precise scope depends on the runtime permissions granted to OpenClaw and the plugin architecture.

Remediation
View remediation

Remediation Suggestions

  • Pin the plugin to an exact, audited version instead of allowing registry-selected resolution.
  • Verify the package with a trusted integrity digest or signed release metadata.
  • Include a lockfile or vendor the reviewed plugin source to make installation reproducible.
  • Review the plugin's installation scripts, runtime permissions, transitive dependencies, and browser communication protocol.
  • Run the plugin in a restricted process or sandbox with minimal filesystem, network, and operating-system permissions.
  • Establish a controlled upgrade process requiring source review and integrity verification for every new version.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:11
Finding

Unrestricted JavaScript Execution in Authenticated Browser Sessions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–13
Additional Locations: SKILL.md, line 30; lines 45–75; lines 119–123
Vulnerability Type: Excessive browser privileges and missing authorization boundaries
Risk Level: High

Vulnerable Code:

markdown
Operate the user's real Chrome browser through Tampermonkey script injection. The agent runs JavaScript directly in the page context — sharing all cookies, sessions, and login state.
markdown
| `tmwd_exec` | Execute JavaScript in page context |
javascript
tmwd_exec(code="document.querySelector('#submit').click()")

tmwd_exec(code="var e=document.querySelector('#email'); e.value='user@example.com'; e.dispatchEvent(new Event('input',{bubbles:true}))")
markdown
## Notes

- All JS runs in page context — shares cookies, localStorage, login state
- `el.click()` is DOM-level, does not move the mouse cursor
- Cross-origin iframes cannot be accessed (same-origin policy)
- If page refreshes, the userscript auto-reconnects with the same sessionId

Technical Analysis

The Skill exposes arbitrary JavaScript execution within the user's real Chrome tabs while explicitly reusing authenticated sessions. It documents both read operations and state-changing actions such as clicking controls and submitting populated form fields.

No origin allowlist, sensitive-site exclusion, read-only mode, per-action confirmation requirement, or separation between inspection and mutation capabilities is defined. Arbitrary tmwd_exec code therefore has the full page-context authority made available by the browser and userscript. Although browser same-origin restrictions still apply, the execution context can access and modify the current origin's DOM, read non-HttpOnly browser storage, and initiate authenticated requests through page behavior.

This excessive authority also increases the impact of indirect prompt injection. Conte ...[truncated 1380 chars]

Remediation
View remediation

Remediation Suggestions

  • Enforce an explicit origin allowlist and deny financial, identity, healthcare, administrative, and other sensitive origins by default.
  • Require informed user approval before attaching to each origin and before every consequential action.
  • Separate read-only inspection tools from mutation tools, granting write capabilities only when strictly required.
  • Replace arbitrary JavaScript execution with narrowly scoped, schema-validated operations wherever possible.
  • Add mandatory confirmation gates for submissions, purchases, transfers, messages, account changes, deletions, and credential-related actions.
  • Prevent webpage content from directly determining tool calls; treat all retrieved content as untrusted data.
  • Redact credentials, tokens, personal information, and sensitive page content from tool output and logs.
  • Provide a visible session indicator, action log, emergency disconnect control, and automatic expiration of browser-control authorization.
  • Use short-lived, origin-scoped capability tokens instead of a persistent session identifier with broad access.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill enables direct JavaScript execution inside the user's logged-in browser context but does not present a prominent warning about the security implications of sharing cookies, localStorage, and active sessions. Without an explicit risk disclosure, users may unknowingly authorize actions that can read sensitive data, modify account state, or perform authenticated operations on their behalf.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are broad enough to activate on ordinary requests like 'check this page for me' or 'open in my browser,' which may unintentionally invoke a powerful browser-control skill. In this context, accidental activation is especially dangerous because the skill can run JavaScript in the user's authenticated page context and interact with sensitive sessions.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
| Action | Code |
|--------|------|
| Click button | `document.querySelector('button.submit').click()` |
| Fill input | `var e=document.querySelector('#input'); e.value='x'; e.dispatchEvent(new Event('input',{bubbles:true}))` |
| Select dropdown | `var s=document.querySelector('select'); s.value='opt1'; s.dispatchEvent(new Event('change',{bubbles:true}))` |
| Check checkbox | `var c=document.querySelector('[type=checkbox]'); c.checked=true; c.dispatchEvent(new Event('change',{bubbles:true}))` |
| Scroll to bottom | `window.scrollTo(0, document.body.scrollHeight)` |

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs the agent to fall back from the user's real authenticated browser session to a separate built-in CDP browser capability. That expands the skill's effective authority and execution surface beyond what the name/primary description suggests, which can bypass user expectations and create unintended automation in a second browser context with persisted state.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The package description explicitly advertises control of the user's real Chrome browser and reuse of existing login sessions, but provides no indication of narrowing, consent boundaries, site restrictions, or action limits. In the context of a browser-control skill backed by Tampermonkey injection, broad unconstrained control can enable account actions, data access, and session abuse across any authenticated site the user has open.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description states that the skill controls the user's real Chrome browser, presenting a fixed browser path without making clear that this is optional or contingent on informed user consent. In this skill's context, forcing a specific browser is more dangerous because that browser likely contains the user's active authenticated sessions, bookmarks, history, and sensitive browsing context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.