ClawHub
Back to skill

Security audit

Agent Browser Fradser Dotclaude

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent browser automation reference, but it normalizes saving and reusing authenticated browser state and accessing cookies/storage without enough safety guidance.

Install only if you intend to let the agent drive browser sessions. Use test or low-privilege accounts where possible, avoid saving authenticated state unless necessary, keep saved state files and recordings out of version control, delete them after use, and review actions before running against real accounts or private sites.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The recording and tracing features are presented as routine workflow tools, but captured videos, screenshots, and traces may include credentials, tokens, PII, page contents, and active session context. Storing or sharing these artifacts without warnings increases the risk of unintended disclosure and downstream compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents commands for reading, setting, and clearing cookies and local storage without any privacy, consent, or data-integrity warning. These capabilities can expose session tokens and personal data or alter application state in ways that affect user privacy, testing fidelity, or account security if used carelessly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation explicitly recommends saving and later loading authenticated browser state (state save auth.json / state load auth.json) without warning that these files can contain session cookies and other authentication material. If mishandled, copied, or committed to source control, an attacker could reuse the saved state to impersonate the user and access protected application data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The example normalizes session persistence across runs by instructing users to load previously saved authentication state. In a browser automation skill, this is especially sensitive because persisted state commonly includes reusable session material, making account takeover or unauthorized access possible if the file is leaked or reused beyond its intended scope.

Content

Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.

agent-browser wait --url "**/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · metadata.json (reported line 4)May include surrounding context.

json
{
  "name": "agent-browser",
  "repo": "FradSer/dotclaude",
  "path": "office/skills/agent-browser/SKILL.md",
  "source": "github.com/FradSer/dotclaude",
  "downloaded_at": "2026-02-04T05:21:57.823131Z",
  "dir_name": "agent-browser-fradser-dotclaude",