Clawhub Publish 146198

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:56 PM UTC
• Version: 0.2.0

Overview

This skill is a browser automation wrapper with legitimate uses, but it asks users to install an unpinned global CLI and enables login/session automation without clear safety boundaries.

Install only if you trust the npm package source and are comfortable with a global browser automation tool. Prefer a pinned, local install in a sandbox or dedicated low-privilege account, and avoid using it with real credentials, cookies, or third-party sites unless you have clear authorization and supervision.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:11

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: skill.md, line 11
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Vulnerable Code

bash

npm install -g agent-browser

Technical Analysis

The skill instructs users to install the agent-browser npm package globally without specifying an exact reviewed version. The project also provides no lockfile, package integrity hash, signature-verification procedure, or trusted registry restriction.

Consequently, npm resolves the package version at installation time. The installed implementation can therefore differ from the implementation originally reviewed. Installation may also run npm lifecycle scripts with the permissions of the invoking user. Because the package is installed globally, its executable becomes available outside this project and may replace or shadow an existing command with the same name.

The audited project contains only documentation and metadata, so the source code of the external npm package cannot be verified from this artifact.

Attack Path

1. An attacker compromises the npm package, its maintainer account, or its publication pipeline and publishes a malicious release.
2. A user follows the prerequisite in skill.md and runs npm install -g agent-browser.
3. npm resolves the attacker-controlled release because no exact version is pinned.
4. Malicious lifecycle scripts may execute during installation, or a malicious agent-browser executable may be installed globally.
5. The user or agent subsequently invokes agent-browser for browser automation.
6. The malicious package executes with the privileges and environment access of the invoking account.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing or invoking user's privileges. Depending on that account's permissions, the malicious package could access local files, environment variables, browser state, cookies, stor ...[truncated 369 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact version that has been reviewed, rather than resolving the latest release:

   bash

   npm install --save-exact agent-browser@<reviewed-version>
   

2. Prefer a project-local installation over npm install -g to limit the package's scope and execute it through a controlled package script or an explicitly resolved local binary.
3. Commit a lockfile containing npm integrity metadata and require reproducible installation with npm ci.
4. Restrict installation to an explicitly configured trusted npm registry.
5. Verify package provenance, publisher identity, signatures, and integrity before installation.
6. Disable lifecycle scripts during installation where compatible:

   bash

   npm ci --ignore-scripts
   

7. If lifecycle scripts are required, review those scripts and the complete transitive dependency tree before permitting execution.
8. Run browser automation in a sandbox or dedicated low-privilege account without unnecessary access to host files, secrets, or unrelated browser profiles.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly enables login automation, form filling, scraping, and cookie/storage/network control against arbitrary websites, but provides no safety boundaries, consent requirements, or warnings about interacting with real accounts and third-party services. In an agent context, this omission increases the chance of credential misuse, unauthorized actions, session theft, or policy-violating automation because the capability is framed as routine and broadly applicable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.