ClawHub
Back to skill

Security audit

Browser Ops High Autonomy

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about high-autonomy browser control, but its scope is broad enough to affect accounts, records, communications, and admin workflows without enough confirmation checkpoints.

Review before installing. Use this only with tightly limited approved domains and low-privilege browser sessions, and add explicit confirmation before sending messages, submitting forms, deleting or modifying records, changing settings or permissions, exporting data, or performing bulk or irreversible actions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
skill.yaml:83
Finding

Overbroad Autonomous Execution Policy Lacks Confirmation for High-Impact Actions

Content
View full analysis

Vulnerability Details

File Location: skill.yaml, lines 83-107
Vulnerability Type: Overbroad autonomous action policy
Risk Level: Medium

Vulnerable Code

yaml
  Objective:
  - Complete browser workflows autonomously across approved domains.
  - Minimize human interruption.

  Mandatory constraints:
  1) Never bypass security controls or access restrictions.
  2) Operate only on approved domains. If a target domain is not approved,
     return DOMAIN_NOT_ALLOWED.
  3) Escalate only for these categories:
     - legal documents/signatures/binding legal acknowledgements
     - payment/payout/billing/bank or tax-payment setup/money movement
     - login verification (OTP/2FA/SMS/email code)
     - security challenge (CAPTCHA/anti-bot/Cloudflare/unusual activity)
  4) If none of the escalation categories apply, proceed automatically when
     technically possible.

  Autonomous actions allowed:
  - customer support workflows
  - email triage and drafting
  - crm update and record maintenance
  - standard form completion/submission
  - administrative workflows
  - product/platform operations
  - routine communication
  - data extraction/research

Technical Analysis

The policy uses a narrow escalation list while granting broad authority over administrative workflows, CRM records, communications, form submissions, and product or platform operations. It explicitly instructs the agent to proceed automatically whenever an action does not fall into one of four restricted categories.

The policy does not require confirmation for several potentially destructive, externally visible, privacy-sensitive, or security-relevant operations, including:

  • Deleting or substantially modifying records.
  • Sending external messages or publishing content.
  • Changing account settings, roles, or permissions.
  • Submitting consequential administrative forms.
  • Exposing or transferring sensitive information through routine communications.
  • Performing irreversibl ...[truncated 1760 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the broad “proceed automatically” default with a narrowly defined allowlist of low-impact, reversible actions.
  2. Require explicit human confirmation before:
    • Deleting records or content.
    • Sending messages to external recipients.
    • Publishing or submitting externally visible content.
    • Changing roles, permissions, access settings, or account configuration.
    • Processing credentials, secrets, personal data, or other sensitive information.
    • Performing irreversible or bulk operations.
  3. Add an escalation status for sensitive or high-impact actions that do not fit the existing legal, payment, login, or security-challenge categories.
  4. Separate drafting from execution. For example, allow autonomous email drafting but require confirmation before sending.
  5. Define action-level permissions for each approved domain instead of treating domain approval as authorization for every available operation.
  6. Apply least privilege to browser sessions and service accounts so the skill cannot access administrative capabilities unnecessary for the intended workflow.
  7. Treat webpage, email, ticket, CRM, and user-generated content as untrusted data rather than executable instructions.
  8. Record proposed actions, affected objects, recipients, and expected consequences before approval, and maintain audit logs for all executed changes.
  9. Prefer reversible operations and provide rollback procedures for record, configuration, and content changes.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · skill.yaml (reported line 89)May include surrounding context.

yaml
- Minimize human interruption.

  Mandatory constraints:
  1) Never bypass security controls or access restrictions.
  2) Operate only on approved domains. If a target domain is not approved,
     return DOMAIN_NOT_ALLOWED.
  3) Escalate only for these categories:

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instruction to proceed automatically whenever listed escalation categories do not apply creates an unsafe default: any action not explicitly recognized as legal, payment, login, or security-related is implicitly allowed. This can let the skill execute destructive, privacy-impacting, or privilege-sensitive browser actions that fall outside those narrow escalation buckets.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is framed as a 'high-autonomy' browser operator that can complete routine tasks end-to-end, but it does not define concrete activation boundaries, prohibited actions, or negative examples. Even though it mentions approved domains and some escalation cases, the scope remains broad enough that an agent could take impactful actions on external systems or accounts without sufficiently precise constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This skill authorizes minimal-interruption browser automation across external platforms, including email, CRM, administrative forms, and platform operations, but it does not warn users about the risks of autonomous actions affecting third-party accounts, sensitive data, or live systems. In context, the listed use cases increase danger because they commonly involve privileged sessions, data modification, and communications that can cause real-world harm if the agent misinterprets instructions or encounters ambiguous states.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · skill.yaml (reported line 11)May include surrounding context.

yaml
mode: high_autonomy

guardrails:
  never_bypass_security_controls: true
  never_bypass_access_restrictions: true
  require_approved_domain: true

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The autonomous scope is extremely broad, including categories like admin workflows, product/platform management, routine communication, and data extraction/research. In a high-autonomy browser skill, these vague permissions can authorize sensitive actions far beyond routine support, increasing the chance of unintended privileged operations or abuse without human review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.