Agent Browser CLI

• Analyzed: May 11, 2026, 5:05 AM
• Findings: 1
• Version: 1.0.0
• Hash: 4da1e95b5e3c44ca8344dd81643d4957c6a2cf208b7bc3e69a46b2f74a113665
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle instructs the AI agent to create and write a shell script (`~/.openclaw/scripts/daily-checkin.sh`) to the filesystem, as shown in `SKILL.md`. While the example script's content is benign (browser automation, screenshot to /tmp), this demonstrates a powerful file write capability that could be exploited via prompt injection for arbitrary code execution or persistence. Additionally, the skill instructs the agent to install global npm packages (`npm install -g agent-browser`), which is another high-risk capability if abused.