ClawHub
Back to skill

Security audit

Lightpanda Scraper

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate web-scraping helper, but it installs and runs an unverified third-party native binary that can change after review.

Install only if you are comfortable trusting the upstream Lightpanda release asset as native code on your machine. Prefer a pinned release with a verified SHA-256 or signature, and use the scraper only on sites you are authorized to access; treat saved scrape output as local data you may need to protect or delete.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:5
Finding
Unverified Mutable Native Binary Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 5 and 17–18 **Vulnerability Type**: Supply-chain risk from an unpinned and unverified native dependency **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🐼","requires":{"bins":["python3"]},"install":[{"id":"lightpanda","kind":"manual","label":"Install Lightpanda binary","commands":["curl -L https://github.com/nicholasgasior/lightpanda-browser/releases/latest/download/lightpanda-linux-x86_64 -o ~/.local/bin/lightpanda","chmod +x ~/.local/bin/lightpanda"]}]}} ``` The same unsafe installation procedure is documented as: ```bash curl -L https://github.com/nicholasgasior/lightpanda-browser/releases/latest/download/lightpanda-linux-x86_64 -o ~/.local/bin/lightpanda chmod +x ~/.local/bin/lightpanda ``` ### Technical Analysis The installation process downloads a precompiled native executable from a third-party GitHub repository through a mutable `releases/latest` URL. It neither pins a reviewed version nor verifies the downloaded artifact with a cryptographic hash or signature before making it executable. Consequently, the code ultimately executed by this skill can change after the skill package has been reviewed. A compromise of the upstream repository, maintainer account, release workflow, or release asset could substitute an attacker-controlled executable. The wrapper later trusts and executes this file from `~/.local/bin/lightpanda` for fetch, CDP server, and MCP operations. HTTPS protects the artifact in transit but does not establish that the latest artifact is the specific reviewed build or protect against compromise of the trusted upstream release process. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, release workflow, or mutable latest-release asset. 2. The attacker replaces `lightpanda-linux-x86_64` with a malicious native executable. 3. A user follows the installation instruct ...[truncated 871 chars]
Remediation
## Remediation Suggestions 1. Pin the dependency to a specific reviewed release instead of using `releases/latest`. 2. Publish the expected SHA-256 digest through a trusted, version-controlled channel and verify it before installation. 3. Prefer cryptographic release signatures with a pinned, independently verified signing key. 4. Download to a temporary file, verify it, and only then atomically move it to `~/.local/bin/lightpanda`. 5. Fail closed: delete the temporary artifact and abort installation if verification fails. 6. Prefer an official, trusted package repository or reproducible build process where available. 7. Document the pinned version, digest, provenance, and upgrade-review procedure so dependency updates require explicit review. 8. Consider sandboxing the browser process and restricting its filesystem and network access to reduce the impact of an upstream compromise.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
args = parser.parse_args()

    if args.mcp:
        os.execv(LIGHTPANDA, [LIGHTPANDA, "mcp"])

    if args.serve:
        os.execv(LIGHTPANDA, [LIGHTPANDA, "serve", "--host", "127.0.0.1", "--port", str(args.port)])
Confidence
85% confidence
Finding
os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
os.execv(LIGHTPANDA, [LIGHTPANDA, "mcp"])

    if args.serve:
        os.execv(LIGHTPANDA, [LIGHTPANDA, "serve", "--host", "127.0.0.1", "--port", str(args.port)])

    if not args.url:
        parser.error("URL required (unless --serve or --mcp)")
Confidence
85% confidence
Finding
os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises and installs capabilities that enable shell execution, network access, and file writes, but it does not declare any tool scope or permission boundaries. That makes it easier for an agent or user to invoke powerful actions without explicit consent controls, increasing the risk of unintended downloads, filesystem modification, or misuse of the scraper against arbitrary targets.

Session Persistence

Medium
Category
Rogue Agent
Content
Install Lightpanda binary:
```bash
mkdir -p ~/.local/bin
curl -L https://github.com/nicholasgasior/lightpanda-browser/releases/latest/download/lightpanda-linux-x86_64 -o ~/.local/bin/lightpanda
chmod +x ~/.local/bin/lightpanda
```
Confidence
91% confidence
Finding
The installation steps persist a downloaded executable in ~/.local/bin, modifying the user's environment beyond the current session. Because the binary is fetched over the network and made executable without any pinned version, checksum, or signature verification, this creates a supply-chain and persistence risk if the download source is compromised or the wrong asset is served.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill promotes web scraping, proxy/Tor use, JavaScript evaluation, and output-file creation without warning users about authorization, privacy, terms-of-service, or local file modification implications. In an agent setting, that omission can lead to unauthorized collection, execution of page-context JavaScript against untrusted content, or silent persistence of scraped data to disk.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
cmd.append(url)

    result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)

    if result.returncode != 0:
        return None, result.stderr.strip()
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
cmd.append(url)

    result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)

    if result.returncode != 0:
        return None, result.stderr.strip()
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
import json

    # Start CDP server
    server = subprocess.Popen(
        [LIGHTPANDA, "serve", "--host", "127.0.0.1", "--port", "9223"],
        stdout=subprocess.PIPE, stderr=subprocess.PIPE
    )
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Internal Network Request

Medium
Category
Server-Side Request Forgery
Content
import urllib.request

        # Get websocket URL
        resp = urllib.request.urlopen("http://127.0.0.1:9223/json/version")
        data = json.loads(resp.read())
        ws_url = data.get("webSocketDebuggerUrl")
Confidence
70% confidence
Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Static analysis

No suspicious patterns detected.