ClawHub
Back to skill

Security audit

Safari Browser Control

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Safari automation guide whose sensitive browser access is expected for its purpose, but users should treat live-session control as privacy-sensitive.

Install this only if you want an agent to operate Safari on your Mac. Prefer WebDriver or a dedicated Safari profile for risky work, and require confirmation before the agent reads tabs, captures screenshots, switches windows, types, clicks, or writes notes under ~/safari/.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md
## Common Mistakes

- Taking screenshots after several actions in a row -> hard to know what changed.
- Capturing Safari without warning when sensitive tabs may be visible -> privacy failure.
- Treating a screenshot as current after the page changed again -> stale evidence.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · screenshot-and-visual-loop.md (reported line 47)May include surrounding context.

md
## Common Mistakes

- Taking screenshots after several actions in a row -> hard to know what changed.
- Capturing Safari without warning when sensitive tabs may be visible -> privacy failure.
- Treating a screenshot as current after the page changed again -> stale evidence.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.md (reported line 54)May include surrounding context.

md
## Guardrails

- Never imply you can see the live browser if direct Safari access is not available.
- Never ask for passwords, raw Keychain exports, or copied credential material.
- Never type blindly into Safari unless focus is verified and the user approved that risk.
- Never present real-session control as equivalent to isolated WebDriver automation.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instructions enumerate open Safari tabs and read tab titles and URLs, which can reveal sensitive browsing history, internal systems, document names, search queries, or authenticated application endpoints. Although tab inspection is relevant to the skill's purpose, exposing this capability without an explicit disclosure or consent step increases the risk of over-collection from the user's live session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs the agent to read visible page text from the user's live Safari session, which can expose sensitive on-screen content such as emails, documents, tokens, or account data. In a browser-control skill, this capability is contextually expected, but the absence of an explicit privacy warning, consent boundary, or data-minimization guidance makes unintended collection of private browsing content a real privacy vulnerability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction to 'Explain storage only if the user asks' reduces transparency about local persistence and causes the agent to withhold material information about what data may be stored under ~/safari/. Hidden or delayed disclosure is dangerous in a browser-control skill because stored permissions, session notes, snippets, or incident data may contain sensitive browsing context that users would reasonably expect to be disclosed before collection or retention.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation guidance is overly broad because it allows the skill to engage whenever Safari-related topics merely 'come up,' which can cause the agent to enter a browser-control mode during ordinary conversation without sufficiently explicit user intent. In a skill capable of interacting with a live browser session, broad triggers increase the risk of unintended access to tabs, cookies, screenshots, and other privacy-sensitive surfaces.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.