ClawHub
Back to skill

Security audit

Owl Browser

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently gives an agent browser-control instructions for a user-configured Owl Browser API, with no hidden persistence or bundled executable payloads.

Install this only with an Owl Browser endpoint you trust. Prefer localhost or a trusted internal HTTPS deployment, protect OWL_API_TOKEN like a password, and avoid using it on sensitive pages unless you are comfortable with the Owl service processing the visited URLs, actions, and observed page content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

The skill depends on curl plus OWL_API_ENDPOINT and OWL_API_TOKEN to transmit requests to an external browser-control API, which creates an outbound data channel by design. While this is core functionality rather than obviously malicious behavior, it still means an agent may send browsing activity and observed page content outside its immediate execution boundary, making the risk context-dependent.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
- OWL_API_ENDPOINT
        - OWL_API_TOKEN
      bins:
        - curl
    primaryEnv: OWL_API_TOKEN
    envVars:
      - name: OWL_API_ENDPOINT

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill instructs the agent to send authenticated browser actions and page observations to an HTTP API using a bearer token, but it does not clearly warn that visited URLs, page content, handles, and interaction data may be transmitted to an external service. In an agent setting, this can expose sensitive browsing targets or page data to a remote endpoint, especially if OWL_API_ENDPOINT is not strictly local or uses insecure transport.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.