Security audit

Clawhub Publish 146156

Security checks for vulnerabilities and agentic risk

Overview

This skill’s browser automation purpose is coherent, but it asks users to globally install an unpinned third-party CLI and exposes sensitive browser-session capabilities without much scoping guidance.

Install only after verifying the `agent-browser` npm package and version you intend to use. Prefer a pinned or local install where possible, and run browser automation in a least-privileged profile without unrelated saved sessions. Avoid entering real credentials or capturing screenshots, videos, cookies, storage, or internal pages unless you explicitly authorize that handling.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: skill.md:12
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
``` 2. Verify the package's official npm identity, publisher, source repository, and release provenance before recommending installation. 3. Publish and verify expected package integrity information or signed release provenance where supported. 4. Prefer a project-local installation governed by a committed lockfile instead of a global installation: ```bash npm install --save-exact agent-browser@ ``` 5. Invoke the locally installed binary through a controlled package script or an explicitly resolved path. 6. Review the package and its transitive dependency tree for lifecycle scripts before adoption. Disable installation scripts with `--ignore-scripts` where compatible with the package's operation. 7. Run browser automation under a dedicated, least-privileged account or sandbox without access to unrelated credentials and sensitive files. 8. Establish a dependency update process in which new versions are reviewed and tested before the pinned version is changed. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly promotes login automation and form filling, which commonly involves usernames, passwords, tokens, and other sensitive user data, but it provides no guidance on secure handling, redaction, or consent. In an agent context, this omission increases the chance that credentials will be entered, logged, or reused insecurely during automated browsing sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Advertising screenshots, PDF export, video recording, and cookie/storage/network control without privacy or security caveats normalizes access to highly sensitive browsing artifacts and session material. These capabilities can expose authentication cookies, personal data, internal pages, and recorded user activity if used by an agent without guardrails.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.