T08 · Insecure Dependencies
Warning
- Location
SKILL.md:27- Finding
Unpinned UI Automation Dependency from a Third-Party Homebrew Tap
- Content
View full analysis
- Remediation
View remediation
Security audit
Chrome Extension Relay Helper - Mac
Security checks for vulnerabilities and agentic risk
Overview
This Mac helper is not deceptive, but it needs Review because it can force-quit Chrome, rewrite the default Chrome profile settings, and save screenshots without clear confirmation.
Install only if you are comfortable letting this helper control your live Chrome session. Save browser work first, expect Chrome to be force-closed, and consider using a dedicated Chrome profile. Treat failure screenshots as potentially sensitive because they may capture whatever is visible on screen.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/attach.sh:50- Finding
Overbroad Forced Termination of Google Chrome Processes
- Content
View full analysis
/dev/null || true ``` ### Technical Analysis The script searches complete process command lines using `pkill -f` and immediately sends `SIGKILL` through `-9`. This match is not restricted to a specific Chrome application PID or to a process owned and launched by this workflow. `SIGKILL` prevents Chrome from performing normal shutdown operations, such as flushing profile state, completing writes, preserving session information, or prompting the user about active work. Matching the complete command line also creates a risk of terminating unrelated processes whose arguments happen to contain the string `Google Chrome`. Suppressing errors with `|| true` prevents the script from distinguishing a successful targeted shutdown from an overbroad or unsuccessful termination attempt. ### Attack Path 1. A user invokes `scripts/attach.sh` while Chrome contains active tabs, downloads, form data, or other unsaved state. 2. The script matches all process command lines containing `Google Chrome`. 3. It sends `SIGKILL` to every matched process without confirmation or a graceful shutdown attempt. 4. Chrome and potentially unrelated matching processes terminate immediately. 5. Pending state writes or user operations are interrupted, which can result in lost work, interrupted activity, or damaged profile state. An attacker with the ability to influence a local process command line could also include the matching text and cause that process to be killed when the Skill runs. This does not provide the attacker with elevated privileges, but it can facilitate denial of service against processes owned by the invoking user. ### Impact Assessment The direct impact is local denial of service and possible loss of browser session data, unsaved work, active do ...[truncated 331 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/attach.sh:53- Finding
Non-Atomic and Silently Failing Rewrite of Chrome Preferences
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 75% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
~/.openclaw/browser/chrome-extension
text Load it via `chrome://extensions` → **Developer mode ON** → **Load unpacked**. **The extension must also be pinned to the toolbar.** The script finds the icon via Chrome's accessibility tree, which only exposes toolbar-pinned extensions — not icons hidden inside the Extensions panel. To pin: click the puzzle-piece icon → click the pin icon next to "OpenClaw Browser Relay".
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script unconditionally force-kills all Google Chrome processes with
pkill -9 -f, which can cause data loss, terminate unrelated browsing sessions, and disrupt the user's environment without consent. In this skill context, that behavior is more dangerous because the script is designed for routine automation and may be invoked by an agent, making destructive interruption of an active browser session likely rather than exceptional.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The embedded Python silently edits Chrome's live Preferences file to change session restore and clean-exit state, altering user browser behavior and potentially masking an abnormal shutdown. This is risky because it tampers with persistent user configuration outside an isolated automation profile, and in the context of a helper skill for agent-driven browser access, it could repeatedly modify a real user's primary Chrome profile without visibility.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill describes behavior that writes to local files by patching Chrome's Preferences, but it does not declare any tool scope or permissions boundary. That creates a transparency and control gap: an agent or reviewer cannot easily distinguish expected UI automation from filesystem modification, increasing the risk of unintended or overbroad local changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill performs disruptive and state-changing actions—killing running Chrome instances and modifying a Chrome preference file—without prominently warning about them in the top-level description or quickstart. This can cause data loss, session interruption, or unexpected browser state changes, especially if invoked automatically as a dependency before other tasks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
On failure, the script captures a screenshot to disk without explicit warning, which may record sensitive page contents, credentials, messages, or other on-screen data unrelated to the relay setup. The skill context increases risk because it operates against a live Chrome session and stores artifacts under the user's home directory, creating persistent local exposure of potentially sensitive information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script repeats screenshot capture during final verification failure, increasing the amount of sensitive visual data persisted to disk without consent and normalizing silent forensic collection. Because this helper is intended to run automatically during browser setup, repeated failure paths can accumulate screenshots of active browsing content and amplify privacy exposure.
- Content
Static analysis
No suspicious patterns detected.