ClawHub
Back to skill

Security audit

browser

Security checks across malware telemetry and agentic risk

Overview

This browser automation skill is mostly purpose-aligned, but its installer and runtime instructions grant broad persistent control that users should review before installing.

Install only if you are comfortable with a persistent Docker browser environment and cross-agent skill files being written. Before setup, review the exact bsession repository and commit, prefer a VNC password, avoid storing secrets in conf files unless they will be masked, and inspect any recurring automation before enabling it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The description says the skill 'works from any repo' and covers setup, fetching, script creation, running, and debugging, which makes routing highly permissive. An overly broad global trigger can cause the skill to activate in unrelated contexts and then execute Docker, shell, or file-modifying workflows the user did not clearly intend.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly scaffolds configuration and Python script files in the workspace but does not warn the user that it will create or modify persistent files. In a global skill, silent persistence is risky because it can leave behind executable automations or altered configs that continue to affect future sessions.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The setup flow tells the agent to run an installation script and container-management commands without an explicit safety warning or confirmation step. Because these actions install software, build images, start containers, and may pull code from a user-provided repository, they can materially change the host environment and expand exposure to supply-chain or misconfiguration risks.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The installer downloads and immediately executes a remote shell script using `curl ... | sh`, which creates a supply-chain execution path with no integrity verification, pinning, or explicit confirmation. In an installer that is meant to be run locally with user privileges, compromise of the remote host, DNS/TLS interception, or an upstream script change would lead to arbitrary code execution on the host.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.