ClawHub
Back to skill

Security audit

Stable Browser

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it sets up persistent browser automation over logged-in sessions in a way users should review carefully.

Install only if you intentionally want a local CDP-controlled Chrome profile. Use a dedicated low-privilege browser account, avoid storing sensitive sessions in the profile, remove --no-sandbox unless you truly need it in an isolated environment, and disable any LaunchAgent or systemd auto-start when not actively using automation.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
scripts/setup-cdp.sh:89
Finding

Persistent Chrome CDP Service Exposes Authenticated Browser Sessions Across Logins

Content
View full analysis
"$PLIST_PATH" << PLIST Label com.openclaw.chrome-cdp ProgramArguments $CHROME_PATH --remote-debugging-port=$CDP_PORT --user-data-dir=$PROFILE_DIR --no-first-run --no-default-browser-check --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-renderer-backgrounding RunAtLoad KeepAlive Crashed StandardOutPath /tmp/chrome-cdp.log StandardErrorPath /tmp/chrome-cdp.err PLIST launchctl unload "$PLIST_PATH" 2>/dev/null || true launchctl load "$PLIST_PATH" 2>/dev/null || true echo "✅ LaunchAgent created (auto-starts on login, restarts on crash)" fi ``` ### Technical Analysis The setup script creates and immediately loads a per-user macOS LaunchAgent. The `RunAtLoad` setting starts the CDP-enabled Chrome instance whenever the user logs in, while `KeepAlive` with `Crashed` restarts it after an unexpected termination. Launching Chrome during the current setup session is necessary to establish a CDP connection. Installing a cross-session startup service is not the minimum privilege or ...[truncated 2423 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/manual-setup.md:63
Finding

Chrome Sandbox Disabled in Documented Linux Launch Configurations

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

profile="openclaw") browser(action="navigate", profile="openclaw", targetUrl="https://example.com") browser(action="screenshot", profile="openclaw")

text

### Key Differences from Extension Relay

| Feature | Extension Relay | CDP Direct |
|---------|----------------|------------|
| Stability | Frequent disconnects | Rock solid |
| Setup | Install extension + attach tab | One-time script |
| Auth/Cookies | Shares your main Chrome | Dedicated profile |
| Speed | Extra hop through extension | Direct protocol |
| Headless | No | Optional (`--headless=new`) |

### Dedicated Profile

The CDP browser uses `~/.chrome-debug-profile` — a separate Chrome profile. This means:
- Log into sites once, stays logged in
- Your main Chrome is untouched
- No extension conflicts
- Survives Chrome updates

### Tips

- **First run**: Log into any sites you need (Google, GitHub, X, LinkedIn, etc.)
- **Multiple tabs**: CDP manages all tabs — use `targetId` to pin a specific tab
- **Headless mode**: Add `-

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/setup-cdp.sh (reported line 123)May include surrounding context.

sh
fi

# 8. Print summary
VERSION=$(curl -s "http://127.0.0.1:$CDP_PORT/json/version" | python3 -c "import sys,json; print(json.load(sys.stdin).get('Browser','unknown'))" 2>/dev/null)
echo ""
echo "═══════════════════════════════════════════════════"
echo "  ✅ Chrome CDP ready!"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding

The skill instructs users to run a shell script and make persistent local configuration changes, but the manifest does not declare any tool scope or allowed-tools boundary. That mismatch reduces transparency and can cause an agent or operator to invoke shell/file-write behavior without explicit permission review, which is risky for a setup skill that modifies browser configuration and startup behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill tells the user to run a setup script that creates a Chrome profile, edits OpenClaw config, installs a macOS LaunchAgent, and verifies connectivity, but these persistent system changes are only described as convenience setup rather than prominently warned about. Silent or under-emphasized persistence and config modification increase the chance of unintended long-lived access and make review harder.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
92% confidence
Finding

Creating a dedicated Chrome profile and encouraging users to remain logged into sites establishes durable session persistence for automated browser control. If the debug endpoint or local environment is compromised, stored authenticated sessions could be abused for account access and actions across multiple services.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

text

This will:
1. Create a dedicated Chrome profile at `~/.chrome-debug-profile`
2. Add `browser.cdpUrl` to your OpenClaw config
3. Create a LaunchAgent (macOS) so Chrome starts on login
4. Verify the connection works

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instructions explicitly enable Chrome's remote debugging interface and point users at a persistent user-data directory, but they do not warn that the DevTools endpoint can expose live browser state, cookies, authenticated sessions, and powerful browser control to other local processes. In the context of a browser automation skill, this is especially sensitive because the browser may be logged into high-value sites and the guide normalizes an insecure setup without discussing access restrictions or profile isolation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

The systemd instructions make the Chrome CDP service persist across sessions, which extends the lifetime of an exposed browser automation endpoint and increases the window during which local compromise or misuse can occur. In this skill's context, persistence makes the earlier remote-debugging risk more dangerous because a continuously running headless browser may retain authenticated state and remain available for unintended access.

Content

Scanner excerpt · references/manual-setup.md (reported line 102)May include surrounding context.

text

```bash
systemctl --user enable chrome-cdp
systemctl --user start chrome-cdp

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup-cdp.sh (reported line 11)May include surrounding context.

sh
PROFILE_DIR="$HOME/.chrome-debug-profile"
CDP_PORT=9222
OPENCLAW_CONFIG="$HOME/.openclaw/openclaw.json"
PLIST_PATH="$HOME/Library/LaunchAgents/com.openclaw.chrome-cdp.plist"

echo "🔧 Setting up Chrome CDP for OpenClaw..."
echo ""

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup-cdp.sh (reported line 11)May include surrounding context.

sh
PROFILE_DIR="$HOME/.chrome-debug-profile"
CDP_PORT=9222
OPENCLAW_CONFIG="$HOME/.openclaw/openclaw.json"
PLIST_PATH="$HOME/Library/LaunchAgents/com.openclaw.chrome-cdp.plist"

echo "🔧 Setting up Chrome CDP for OpenClaw..."
echo ""

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script creates and immediately loads a macOS LaunchAgent that persists across logins and restarts Chrome with remote debugging enabled, without prompting the user or requiring explicit opt-in. This expands the security impact beyond a one-time setup: if the profile contains authenticated sessions, a persistent CDP-enabled browser can expose local account data or enable ongoing browser automation without the user realizing it remains active.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

Beginning at this heredoc, the script writes a LaunchAgent plist that causes Chrome to start automatically with remote debugging enabled. Persistence of a debuggable browser increases exposure because authenticated browser state in the dedicated profile can remain continuously available to local automation or abuse after reboot/login.

Content

Scanner excerpt · scripts/setup-cdp.sh (reported line 84)May include surrounding context.

sh
# 7. Create LaunchAgent for auto-start (macOS only)
if [ "$(uname)" = "Darwin" ]; then
    mkdir -p "$(dirname "$PLIST_PATH")"
    cat > "$PLIST_PATH" << PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

This line is part of the persisted LaunchAgent content and contributes to installing a login item that restarts a CDP-enabled Chrome session. Persistence is relevant here because it keeps a powerful browser control interface available beyond the current session.

Content

Scanner excerpt · scripts/setup-cdp.sh (reported line 85)May include surrounding context.

sh
# 7. Create LaunchAgent for auto-start (macOS only)
if [ "$(uname)" = "Darwin" ]; then
    mkdir -p "$(dirname "$PLIST_PATH")"
    cat > "$PLIST_PATH" << PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

This duplicate match is still part of the same persistent LaunchAgent creation flow. The risk comes from establishing long-lived auto-start behavior for a remote-debuggable browser instance.

Content

Scanner excerpt · scripts/setup-cdp.sh (reported line 87)May include surrounding context.

sh
mkdir -p "$(dirname "$PLIST_PATH")"
    cat > "$PLIST_PATH" << PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

This duplicate match is still part of the same persistent LaunchAgent creation flow. The risk comes from establishing long-lived auto-start behavior for a remote-debuggable browser instance.

Content

Scanner excerpt · scripts/setup-cdp.sh (reported line 87)May include surrounding context.

sh
mkdir -p "$(dirname "$PLIST_PATH")"
    cat > "$PLIST_PATH" << PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

This line continues the plist creation for a LaunchAgent that will persist the CDP-enabled Chrome process. A persistent background browser with stored sessions can increase the blast radius of local compromise or misuse by other tools on the host.

Content

Scanner excerpt · scripts/setup-cdp.sh (reported line 88)May include surrounding context.

sh
cat > "$PLIST_PATH" << PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.openclaw.chrome-cdp</string>

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

This line closes the persisted plist definition that configures automatic startup and logging for the CDP browser. It is part of the effective persistence mechanism and therefore a valid security-relevant finding.

Content

Scanner excerpt · scripts/setup-cdp.sh (reported line 115)May include surrounding context.

sh
<key>StandardErrorPath</key>
    <string>/tmp/chrome-cdp.err</string>
</dict>
</plist>
PLIST
    launchctl unload "$PLIST_PATH" 2>/dev/null || true
    launchctl load "$PLIST_PATH" 2>/dev/null || true

Session Persistence

Medium
Category
Rogue Agent
Confidence
97% confidence
Finding

This line marks the end of the heredoc used to write the LaunchAgent, directly participating in installing a persistent auto-start configuration. In context, that means the script is not merely launching Chrome temporarily; it is establishing continued availability of a debuggable browser service.

Content

Scanner excerpt · scripts/setup-cdp.sh (reported line 116)May include surrounding context.

sh
<string>/tmp/chrome-cdp.err</string>
</dict>
</plist>
PLIST
    launchctl unload "$PLIST_PATH" 2>/dev/null || true
    launchctl load "$PLIST_PATH" 2>/dev/null || true
    echo "✅ LaunchAgent created (auto-starts on login, restarts on crash)"

Session Persistence

Medium
Category
Rogue Agent
Confidence
98% confidence
Finding

The unload/load sequence is part of activating the persistence immediately, making the LaunchAgent effective without further user action. This is a true persistence mechanism and increases risk because it silently transitions from setup to permanent background behavior.

Content

Scanner excerpt · scripts/setup-cdp.sh (reported line 117)May include surrounding context.

sh
</dict>
</plist>
PLIST
    launchctl unload "$PLIST_PATH" 2>/dev/null || true
    launchctl load "$PLIST_PATH" 2>/dev/null || true
    echo "✅ LaunchAgent created (auto-starts on login, restarts on crash)"
fi

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

This duplicate match refers to the same line that activates the persistent LaunchAgent. The underlying risk is valid even though the detector produced a repeated result.

Content

Scanner excerpt · scripts/setup-cdp.sh (reported line 118)May include surrounding context.

sh
</plist>
PLIST
    launchctl unload "$PLIST_PATH" 2>/dev/null || true
    launchctl load "$PLIST_PATH" 2>/dev/null || true
    echo "✅ LaunchAgent created (auto-starts on login, restarts on crash)"
fi

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

This duplicate match refers to the same line that activates the persistent LaunchAgent. The underlying risk is valid even though the detector produced a repeated result.

Content

Scanner excerpt · scripts/setup-cdp.sh (reported line 118)May include surrounding context.

sh
</plist>
PLIST
    launchctl unload "$PLIST_PATH" 2>/dev/null || true
    launchctl load "$PLIST_PATH" 2>/dev/null || true
    echo "✅ LaunchAgent created (auto-starts on login, restarts on crash)"
fi

Static analysis

No suspicious patterns detected.