Browser Zombie Cleaner.Removed

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:44 PM UTC
• Version: 1.0.0

Overview

This skill has a coherent cleanup purpose, but its kill mode can terminate more processes than its documentation promises.

Review this skill before installing or running it automatically. Use detect-only mode first, inspect the listed PIDs, avoid broad or empty --pattern values, and do not run --kill from a privileged health-check account unless the process-group targeting and log path are hardened.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/cleanup-zombie-browsers.sh:343

Finding

Unverified Process-Group Termination Can Kill Unrelated Processes

Content

View full analysis

/dev/null | tr -d ' ')" 2>/dev/null \ || kill -TERM "$pid" 2>/dev/null \ || { log "PID $pid already gone"; continue; } # Wait for graceful exit waited=0 while (( waited < GRACE_PERIOD_SECONDS )); do if ! kill -0 "$pid" 2>/dev/null; then log "PID $pid and children terminated gracefully" break fi sleep 1 waited=$((waited + 1)) done # SIGKILL if still alive if kill -0 "$pid" 2>/dev/null; then log "PID $pid did not exit after ${GRACE_PERIOD_SECONDS}s, sending SIGKILL" kill -KILL -- "-$(ps -o pgid= -p "$pid" 2>/dev/null | tr -d ' ')" 2>/dev/null \ || kill -KILL "$pid" 2>/dev/null || true fi ``` ### Technical Analysis A negative PID passed to `kill` addresses an entire process group rather than only the validated browser PID. The discovery logic validates one process as a current-user, orphaned OpenClaw browser, but the script does not enumerate or validate every member of that process group before sending SIGTERM or SIGKILL. Process-group membership does not guarantee that every member is a descendant of the selected browser or that every member satisfies the OpenClaw command-line, ownership, orphan-status, and age checks. Consequently, the destructive operation has a broader scope than the documented browser-only safety boundary. The `child_count` calculation does not mitigate this issue. It only counts direct children and is not used to constrain which processes receive the signal. ### Attack Path 1. A qualifying browser process is placed in, or remains part of, a process group that also contains unrelated processes. 2. The ...[truncated 1025 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cleanup-zombie-browsers.sh:329

Finding

Configurable Browser Pattern Weakens Target Selection and Kill-Time Revalidation

Content

View full analysis

/dev/null)" || continue if [[ "$verify_cmdline" != *"$OPENCLAW_BROWSER_PATTERN"* ]]; then log "SKIP PID $pid: re-verification failed (cmdline changed)" continue fi fi ``` ### Technical Analysis The `--pattern` option accepts an arbitrary string without validating that it is nonempty, sufficiently specific, or tied to the expected OpenClaw browser directory. An empty pattern matches every command line under Bash wildcard comparison, while a broad pattern can match browser processes unrelated to OpenClaw. The kill-time check is also incomplete. Although its comment states that the process still matches the criteria, it only verifies that the command line contains the configurable pattern. It does not repeat the following safety checks: - Current-user ownership - Browser executable identity - Orphan status - Minimum process age - Process start time or another PID-reuse-resistant identifier The gap between discovery and signaling therefore creates a time-of-check/time-of-use weakness. A candidate may no longer meet the original policy when the signal is sent. ### Attack Path 1. The caller supplies an empty or overly broad value through `--pattern`. 2. The command-line origin check begins accepting browser processes that were not launched with the intended OpenClaw browser directory. 3. An accepted process also satisfies the orphan a ...[truncated 927 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cleanup-zombie-browsers.sh:31

Finding

Predictable Log Path Permits Symlink-Based File Modification

Content

View full analysis

> "$LOG_FILE" if [[ "$OUTPUT_FORMAT" == "text" ]]; then echo "$msg" fi } ``` ### Technical Analysis The default log is placed under a predictable `/tmp` path. The script creates the parent directory without setting restrictive permissions and opens the log with shell append redirection without validating: - Whether the parent directory is owned by the invoking user - Whether the log path is a symbolic link - Whether the destination is a regular file - Whether an existing file is owned by the expected user - Whether the path changed between validation and opening The path can also be overridden through the environment or command-line option. Although configurable logging is intentional, unrestricted append operations become dangerous when the script is used by an automated or privileged account. Standard shell redirection follows symbolic links. Therefore, an attacker able to control the predictable temporary path may redirect log writes to another file writable by the invoking account. ### Attack Path 1. An attacker creates or controls `/tmp/openclaw` before the cleanup script runs, or otherwise gains write access to the configured log directory. 2. The attacker creates `zombie-browser-cleanup.log` as a symbolic link to another file. 3. A more privileged or different automation account invokes the script using the predictable default path. 4. The shell follows the symbolic link when executing `echo "$msg" >> "$LOG_FILE"`. 5. Audit text is appended to the symlink target under the invoking account's permission ...[truncated 652 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This manifest is a markdown file with frontmatter, so vague-trigger review applies. The trigger "chrome memory" is short and generic enough to match common user speech about browser performance, without clearly limiting activation to OpenClaw orphan-process cleanup.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

"Browser cleanup" could refer to many unrelated tasks such as clearing cache, cookies, tabs, or uninstalling browsers. The file does not pair the trigger list with exclusion conditions or negative examples, so this phrase risks unintended invocation outside the intended orphaned-process use case.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script advertises that it only targets specific orphaned OpenClaw browser processes, but in kill mode it re-verifies only the OpenClaw path substring and then sends signals to the entire process group. If an unrelated process shares that process group, it may be terminated even though it was never validated as a browser, orphan, same-age candidate, or intended cleanup target. In an operational cleanup skill, that mismatch between documented scope and actual kill behavior makes accidental denial-of-service plausible.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

Natural-language policy review applies to all file types. The manifest mixes English and Chinese triggers, but does not explain whether multilingual activation is optional or how language selection is determined, creating a mild locale-policy concern around implicit language handling.

Content

No source excerpt is available for this finding.