ClawHub
Back to skill

Security audit

Agent Browser Qw

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate browser automation skill, but it gives an agent broad control over logged-in browsing data and saved session artifacts without enough safety boundaries.

Install only if you need agent-driven browser automation. Use isolated browser profiles or test accounts when possible, verify or pin the external npm package, and require explicit approval before reading cookies/storage, saving or loading auth state, exporting screenshots/traces/recordings/PDFs, uploading files, submitting forms, or using this on sensitive logged-in accounts. Delete saved auth files and captured artifacts when finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly documents saving screenshots, PDFs, recordings, traces, and browser state to local files but provides no warning that these artifacts may contain authentication tokens, page content, form data, or other secrets. In an agent setting, users may run these commands on sensitive sites, causing credentials or session material to be written to disk and later exposed through logs, backups, or workspace sharing.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
These commands expose and manipulate highly sensitive browser data including cookies, localStorage, HTTP credentials, request history, and mocked/intercepted network traffic, yet the documentation does not warn that this data may include session tokens, personal data, or secrets. In an AI-agent workflow, such commands materially increase the chance of credential harvesting, replay, or accidental disclosure because the agent may print or persist the values during normal operation.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.