T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/dedication_automation.mjs:511- Finding
Undocumented Automation Performs Actions in Authenticated Third-Party Accounts
- Content
View full analysis
- Remediation
View remediation
Security audit
browserbase-sessions
Security checks for vulnerabilities and agentic risk
Overview
The core Browserbase automation is mostly disclosed, but the package also ships an undocumented ChatGPT/Suno automation path and uses high-risk default persistence and installation behavior.
Review before installing. Use this only if you are comfortable with Browserbase cloud sessions holding authenticated browser state, recordings, logs, cookies, downloads, screenshots, and live control URLs. Treat control URLs and cookie output as secrets, isolate workspaces per site or account, disable recording/logging/captcha solving/persistence when not needed, and avoid the undocumented dedication npm script unless you intentionally want it to act in ChatGPT and Suno under your accounts. Install dependencies in a dedicated virtual environment with pinned versions rather than using the built-in system-level installer.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Error
- Location
scripts/requirements.txt:1- Finding
Unpinned Dependencies Are Automatically Installed into the System Python Environment
- Content
View full analysis
=1.4.0 playwright>=1.40.0 ``` ```python in_venv = sys.prefix != getattr(sys, "base_prefix", sys.prefix) uv = shutil.which("uv") if prefer_uv else None if uv: if in_venv: steps.append({ "step": "installer", "status": "ok", "message": f"Using uv at {uv} (target prefix: {sys.prefix})", }) pip_argv = ["uv", "pip", "install", "--prefix", sys.prefix, "-r", req_path] else: steps.append({ "step": "installer", "status": "ok", "message": ( "Using uv with --system --break-system-packages " "(non-venv Python detected)" ), }) pip_argv = [ "uv", "pip", "install", "--system", "--break-system-packages", "-r", req_path, ] else: if in_venv: steps.append({ "step": "installer", "status": "ok", "message": "Using pip in active virtual environment", }) pip_argv = [sys.executable, "-m", "pip", "install", "-r", req_path] else: steps.append({ "step": "installer", "status": "ok", "message": "Using pip with --break-system-packages (non-venv Python detected)", }) pip_argv = [ sys.executable, "-m", "pip", "install", "--break-system-packages", "-r", req_path, ] ok, info = _run_subprocess(pip_argv) steps.append({ "step": "python_deps", "status": "ok" if ok else "er ...[truncated 2894 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/browserbase_manager.py:657- Finding
Authentication State, Session Recordings, and Logs Are Persisted Remotely by Default
- Content
View full analysis
None: """Create a new Browserbase browser session.""" client = get_client() project_id = get_project_id() # Resolve context name → ID if needed context_id = _resolve_context(args.context_id) if args.context_id else None # Build browser settings (Python SDK expects snake_case keys). # Captcha solving + recording are ON by default on Browserbase; be explicit so # flags like --no-record actually take effect. browser_settings: dict[str, Any] = { "solve_captchas": not args.no_solve_captchas, "record_session": not args.no_record, "log_session": not getattr(args, "no_logs", False), } if context_id: browser_settings["context"] = { "id": context_id, "persist": args.persist, } ``` The command-line parser makes persistence opt-out: ```python p_cs.add_argument( "--persist", dest="persist", action="store_true", default=True, ) p_cs.add_argument( "--no-persist", dest="persist", action="store_false", help="Disable context persistence on close (not recommended)", ) ``` The reference documentation establishes that remote contexts are long-lived: ```markdown - **Contexts never expire** on Browserbase's side - **persist: true** saves cookies/storage changes back to context on close - **keepAlive: true** lets sessions survive disconnections (must terminate manually) ``` ### Technical Analysis For newly created sessions, recording and logging are enabled unless the caller explicitly supplies disabling flags. When a context is selected, persistence ...[truncated 2285 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (39)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description frames the skill as session management, but the documented behavior goes much further: arbitrary page interaction, authenticated content extraction, JavaScript execution, cookie retrieval, download access, logs, recordings, and live remote control. That mismatch is dangerous because policy engines, reviewers, and users may approve the skill for a narrower purpose while it actually enables extensive authenticated browsing and potential data exfiltration.
- Content
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md `POST /v1/contexts` with `{"projectId": "<project-id>"}` Returns object with `id`. ### Delete Context `DELETE /v1/contexts/{id}` → 204 No Content (permanent) ### Session Logs
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md Returns object with `id`. ### Delete Context `DELETE /v1/contexts/{id}` → 204 No Content (permanent) ### Session Logs `GET /v1/sessions/{id}/logs` → Array of log entries (timestamps, methods, params)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python value = os.environ.get(name) if not value: output_error(f"Environment variable {name} is not set. " f"Set it or configure via OpenClaw's skills.entries[\"browserbase-sessions\"].env " f"(and you can use skills.entries[\"browserbase-sessions\"].apiKey for BROWSERBASE_API_KEY).") sys.exit(1) return value
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
python }) except urllib.error.HTTPError as e: body = e.read().decode() if e.fp else "" output_error(f"Failed to delete context (HTTP {e.code}): {body}") sys.exit(1) except Exception as e: output_error(f"Failed to delete context: {e}")
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
python }) except urllib.error.HTTPError as e: body = e.read().decode() if e.fp else "" output_error(f"Failed to delete context (HTTP {e.code}): {body}") sys.exit(1) except Exception as e: output_error(f"Failed to delete context: {e}")
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script materially exceeds the stated skill purpose of creating/managing Browserbase sessions by automating logged-in ChatGPT and Suno workflows to generate content. In an agent-skill context, this is dangerous because it uses persisted authenticated browser contexts to act in third-party services, increasing the chance of unauthorized actions, account misuse, and unexpected charges under the user's identity.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 83% confidence
- Finding
Session persistence is an intended feature here, but in this skill context it materially increases risk because it preserves authenticated state across runs and potentially across users or tasks. That is not inherently malicious, yet without strong safeguards and warnings it can expose long-lived authenticated sessions, enabling unauthorized reuse if workspace data or context identifiers are mishandled.
- Content
md This skill gives the OpenClaw agent the ability to: - **Create cloud browser sessions** via Browserbase's infrastructure - **Persist authentication** across sessions using Contexts (cookies, local storage, session storage are saved and restored automatically) - **Use workspaces for persistence** — a workspace ties together a Context + active session id
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README describes persistence of cookies, local storage, and session storage across sessions without warning that these artifacts may contain authentication tokens and other sensitive account data. Because the skill is specifically designed to maintain logged-in browser state, insufficient guidance increases the risk of credential theft, cross-user leakage, or insecure retention of secrets.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README promotes automatic CAPTCHA solving and session recording as enabled by default, but does not clearly warn users about compliance, privacy, or consent requirements. In a browser automation skill that may access third-party accounts and protected flows, this can lead to unauthorized circumvention of access controls or recording of sensitive user activity without adequate notice.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 97% confidence
- Finding
The skill exposes powerful capabilities including shell, network, file read/write, environment access, and browser automation, but it does not declare any explicit tool scope or allowed-tools restrictions. In practice, this means an agent may invoke broad system and network actions under the guise of browser session management, increasing the chance of unintended command execution, data access, or exfiltration beyond the user's expectations.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill is explicitly designed to persist authenticated browser state across interactions, including cookies, storage, tabs, and workspace state. While that is a legitimate feature, it materially increases security risk because stolen local workspace files, reused contexts, or overbroad agent actions can access already-authenticated sessions and sensitive account data without requiring fresh login.
- Content
md --- name: browserbase-sessions description: Create and manage persistent Browserbase cloud browser sessions with authentication persistence. Use when you need to automate browsers, maintain logged-in sessions across interactions, scrape authenticated pages, or manage cloud browser instances. license: MIT homepage: https://docs.browserbase.com metadata: {"author":"custom","version":"2.5.0","openclaw":{"emoji":"🌐","requires":{"bins":["python3"]},"primaryEnv":"BROWSERBASE_API_KEY"}}
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The reference explicitly documents session recording, logs, downloads, and persistent browser contexts, all of which can contain cookies, authentication tokens, personal data, and sensitive page contents. In a skill whose purpose is to maintain logged-in browser sessions, omitting clear privacy, retention, and consent warnings increases the chance that operators will unintentionally capture and persist sensitive authenticated data.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 86% confidence
- Finding
Persistent contexts and workspaces intentionally preserve authentication state across sessions, including cookies and storage. In this skill's context that is core functionality, but it is still security-relevant because compromise of the local state, remote context, or associated sharing/export features can expose long-lived authenticated access.
- Content
python install Install Python deps + Playwright Chromium (best-effort) setup Validate credentials and run a smoke test list-projects List accessible Browserbase projects (helps find Project ID) create-context Create a new persistent context delete-context Delete a context list-contexts List locally saved named contexts create-workspace Create a named workspace (context + tab history)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises session management but actually exposes broad browser automation, page reading, cookie access, downloads, screenshots, recordings, and JS execution. That capability expansion increases the blast radius substantially because an agent granted this skill can interact with authenticated sites and extract sensitive content well beyond simple session lifecycle management.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # --------------------------------------------------------------------------- _WORKSPACE_NAME_RE = re.compile(r"^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$") _BROWSERBASE_API_BASE = "https://api.browserbase.com/v1" def _utc_now_iso() -> str:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python # --------------------------------------------------------------------------- _WORKSPACE_NAME_RE = re.compile(r"^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$") _BROWSERBASE_API_BASE = "https://api.browserbase.com/v1" def _utc_now_iso() -> str:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python # --------------------------------------------------------------------------- _WORKSPACE_NAME_RE = re.compile(r"^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$") _BROWSERBASE_API_BASE = "https://api.browserbase.com/v1" def _utc_now_iso() -> str:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def _run_subprocess(argv: list[str]) -> tuple[bool, dict[str, Any]]: """Run a subprocess and return (ok, info).""" try: cp = subprocess.run(argv, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=True) return True, { "returncode": cp.returncode, "stdout": _truncate_output(cp.stdout),
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The built-in messaging explicitly encourages sharing a live browser control link with the user, which can expose authenticated state and sensitive page data to whoever receives that URL. In the context of persistent authenticated sessions, this materially increases the chance of inadvertent session exposure or unauthorized remote control.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The execute-js command permits arbitrary JavaScript execution in the context of authenticated pages. That enables direct access to DOM content, tokens visible to page scripts, local/session storage, and arbitrary in-page actions, making the skill much more powerful and dangerous than its stated session-management purpose suggests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The get-cookies command returns all cookies from the browser context, which can include session and authentication cookies for logged-in sites. In a skill specifically designed to maintain persistent authenticated browser sessions, this is highly sensitive because cookie disclosure can enable session hijacking or downstream credential abuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Session recordings can capture page content, user interactions, secrets typed into pages, and authenticated activity, and this command writes that data directly to disk. Persisting such material locally without strong warnings, retention limits, or access controls raises the risk of accidental disclosure and sensitive-data sprawl.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The suggested user message automates passing through free-form human instructions together with a live control link, normalizing the exposure of direct session access in plain language. This reduces friction for unsafe sharing and can lead agents or operators to disclose access to authenticated browser sessions without adequate review.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file contains extensive application-specific logic for prompting ChatGPT, parsing responses, detecting Suno UI state, filling forms, and initiating song creation. That hidden task-specific automation is risky in a session-management skill because users may grant browser/session access expecting infrastructure help, while the code performs unrelated authenticated actions on external services.
- Content
Static analysis
No suspicious patterns detected.