ClawHub
Back to skill

Security audit

Browser Automation

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent browser-automation guide, but it teaches use of a real logged-in browser, credential entry, form submission, and arbitrary page JavaScript without strong enough safety boundaries.

Install only if you intend to let the agent automate browser actions and you understand the difference between sandbox browsing and your real browser session. Prefer sandbox mode for routine scraping or form tests. Do not allow host/user-browser use, login automation, arbitrary evaluate scripts, or account-changing clicks unless you are present and have explicitly approved the specific action.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill prominently advertises operation against the host machine and logged-in user browser but does not place an equally clear warning near the top that this can expose cookies, authenticated content, and sensitive account actions. In a browser automation context, lack of up-front safety framing makes dangerous use more likely because users may not distinguish sandbox browsing from access to their real session.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The login recipe demonstrates direct entry of a username and password into a host browser without an explicit secret-handling warning or approval boundary. This normalizes credential entry through the automation interface and could lead users or downstream agents to handle real secrets insecurely, especially in conjunction with screenshots, DOM snapshots, console access, or arbitrary evaluation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrases are broad and overlap with many normal browsing or scraping requests, increasing the chance that the skill activates in contexts where browser control was not intended. Because this skill can drive a real browser, submit forms, and access host/user sessions, accidental invocation materially raises the risk of unintended navigation, data access, or side effects.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · skill.md (reported line 166)May include surrounding context.

md
// 1. Navigate to form
browser(action="navigate", target="sandbox", url="https://example.com/contact")

// 2. Fill inputs
browser(action="act", target="sandbox", ref="id:name",    request={"kind": "fill", "text": "Alice Smith"})
browser(action="act", target="sandbox", ref="id:email",   request={"kind": "fill", "text": "alice@example.com"})
browser(action="act", target="sandbox", ref="id:message", request={"kind": "fill", "text": "Hi, I'd like to know more..."})

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example login flow instructs automation of real credential entry into the host/user browser session, which can expose secrets and enable privileged account actions if misused. In this skill's context, the danger is amplified because the same browser can access active sessions and subsequent actions can navigate, extract data, take screenshots, or submit forms under the user's identity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly documents an evaluate action that accepts arbitrary JavaScript strings and executes them in the page context. While in-page JS execution is a legitimate browser automation feature, exposing it in a general-purpose skill significantly broadens capability to include DOM exfiltration, hidden form interaction, token harvesting from page state, and bypass of higher-level action safety constraints, especially when combined with host or user-session browsing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The introductory documentation states that using the logged-in user browser is done with profile="user". However, the concrete login example switches to target="host" and never uses profile="user", which gives conflicting guidance about how user-session automation is actually selected.

Content

No source excerpt is available for this finding.