ClawHub
Back to skill

Security audit

Browser Agent - Chrome CDP 自动化

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is coherent, but it asks users to expose high-impact browser control over authenticated sessions with weak scoping and safety guidance.

Install only if you understand that this can control a real browser as you, including logged-in accounts. Use a dedicated automation Chrome profile with no personal sessions, avoid `--remote-allow-origins=*`, keep CDP bound to localhost, close the browser when done, and require explicit review before posting, deleting, typing credentials, running JavaScript, or capturing screenshots on sensitive pages.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:34
Finding

Wildcard CDP WebSocket Origin Allowlist Exposes Authenticated Browser Sessions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:34-43
Additional Location: 测试报告.md:163-183
Vulnerability Type: Unsafe Chrome DevTools Protocol configuration
Risk Level: High

Vulnerable Code

bash
chrome.exe --remote-debugging-port=9222 --remote-allow-origins=* --user-data-dir="C:\chrome-profile"
bash
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome \
  --remote-debugging-port=9222 --remote-allow-origins=* \
  --user-data-dir="/tmp/chrome-profile"

Technical Analysis

The documented --remote-allow-origins=* option instructs Chrome to accept CDP WebSocket connections from every origin. This disables an origin-based security control that would otherwise reject unauthorized WebSocket clients.

CDP provides extensive control over the attached browser, including:

  • Executing arbitrary JavaScript in pages through Runtime.evaluate
  • Reading page content and DOM state
  • Navigating tabs and submitting forms
  • Simulating mouse and keyboard input
  • Capturing screenshots
  • Performing actions through existing authenticated sessions

The Skill explicitly promotes reuse of logged-in browser profiles, cookies, login state, and background permissions. Consequently, weakening CDP origin validation can expose substantially more than an isolated automation tab.

A wildcard origin is not required for the declared browser-automation functionality. The specific trusted automation origin can be allowlisted instead. The test report confirms that Chrome originally returned HTTP 403 because of its origin protection and that the wildcard option was presented as the workaround.

Attack Path

  1. A user follows the Skill documentation and starts Chrome with remote debugging and --remote-allow-origins=*.
  2. The browser uses a persistent profile containing authenticated website sessions.
  3. The user opens attacker-controlled content, or an untrusted local client gains ...[truncated 1435 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the wildcard with the exact trusted automation origin:

    bash
    --remote-allow-origins=http://127.0.0.1:18800

    The permitted origin must match the actual trusted client configuration.

  2. Ensure the debugging service listens only on loopback:

    bash
    --remote-debugging-address=127.0.0.1

  3. Use a dedicated automation profile that does not contain personal browsing sessions or unrelated authenticated accounts.

  4. Do not load untrusted websites while the debugging interface is active.

  5. Shut down the debugging browser immediately after the automation task completes.

  6. Update SKILL.md and 测试报告.md to remove the wildcard recommendation and explain the risks of exposing an authenticated profile through CDP.

  7. Prefer the OpenClaw browser integration when it provides authenticated and origin-restricted CDP access without disabling Chrome's protection globally.

T08 · Insecure Dependencies

Warning
Location
scripts/requirements.txt:4
Finding

Unpinned Python Dependencies Permit Unreviewed Future Releases

Content
View full analysis

Vulnerability Details

File Location: scripts/requirements.txt:4-7
Additional Location: package.json:28-29
Vulnerability Type: Non-reproducible and insufficiently constrained dependencies
Risk Level: Medium

Vulnerable Code

text
websocket-client>=1.6.0
requests>=2.31.0

The documented installation command is:

bash
pip install -r requirements.txt

Technical Analysis

Both dependencies use open-ended lower-bound constraints. Any later package release satisfying the minimum version can therefore be selected during installation. The project does not provide:

  • Exact reviewed versions
  • A dependency lock file
  • Package hashes
  • An upper compatibility bound
  • An isolated-environment requirement

This makes installation non-reproducible and expands the supply-chain trust boundary to include all future releases of both packages and their transitive dependencies.

The package names and configured package source are not suspicious, and the reviewed project does not contain evidence that either dependency is currently malicious. The risk arises from accepting future or compromised releases without integrity verification.

Attack Path

  1. An upstream dependency, transitive dependency, or package-publishing account is compromised.
  2. An attacker publishes a malicious version that satisfies the applicable >= constraint.
  3. A user runs the documented pip install -r requirements.txt command.
  4. The package resolver selects the malicious or otherwise unreviewed release.
  5. Installation-time package behavior or subsequently imported code executes with the privileges of the user running the Skill.
  6. The compromised dependency can access files, network resources, environment data, and browser automation capabilities available to that process.

This path depends on an upstream supply-chain compromise or malicious future release; no such compromise was identified in ...[truncated 640 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin dependencies to reviewed exact versions:

    text
    websocket-client==1.9.0
requests==2.32.5

  2. Generate and maintain a lock file that includes transitive dependencies.

  3. Record cryptographic hashes and install with hash enforcement:

    bash
    pip install --require-hashes -r requirements.txt

  4. Require installation inside a dedicated virtual environment rather than a global or privileged Python environment.

  5. Perform dependency updates through a reviewed process that includes vulnerability scanning, changelog review, and automated tests.

  6. Avoid running pip install as an administrator or root user.

  7. Keep dependency declarations in package.json consistent with the authoritative Python lock or requirements file.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (24)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README explicitly promotes social-media automation actions such as bulk posting/deleting tweets and automated likes/retweets without any warning about account-safety, platform-policy, consent, or abuse risks. In the context of a browser-control skill that can act on authenticated sessions, this lowers user caution and can enable unauthorized or policy-violating actions against third-party accounts or content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The custom-script example includes automated entry of login credentials, including a hardcoded password, with no warning about secret handling or authenticated-session risks. In a browser automation skill, this is dangerous because users may imitate the pattern, store real credentials in scripts, or expose secrets through logs, screenshots, repositories, or shared profiles.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly promotes reusing logged-in browser sessions via CDP and preserved cookies/login state, but does not present a prominent warning that this grants the agent access to sensitive authenticated state. In practice, this can let automation read private data, act as the user across sites, and exfiltrate session-derived information if misused or prompted unsafely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill advertises actions such as bulk deleting or publishing Twitter/social-media content without a strong warning that the automation can perform irreversible account actions on the user's behalf. Because the skill integrates direct browser control with persistent sessions, prompt mistakes or abuse could cause unauthorized posts, deletions, or cross-platform account changes at scale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file contains user-facing instructional content exclusively in Chinese, including the title, section headings, and inline explanations. Under the policy rules, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring explicitly advertises bypassing browser security warning dialogs via raw CDP control. Even though this is documentation rather than code, it signals an intended security-evasion use case and increases the likelihood that the tool will be used to suppress protections around unsafe browsing, certificate errors, or other warning interstitials.

Content

No source excerpt is available for this finding.

Dynamic Request Target

Medium
Category
Server-Side Request Forgery
Confidence
60% confidence
Finding

Request target host is built from a dynamic or untrusted value. If the host is attacker-influenced, this enables SSRF to arbitrary internal or metadata endpoints.

Content

Scanner excerpt · scripts/browser_agent.py (reported line 46)May include surrounding context.

python
def get_debugger_url(self) -> str:
        """获取 WebSocket 调试器 URL"""
        try:
            resp = requests.get(f"http://{self.host}:{self.port}/json/version", timeout=5)
            data = resp.json()
            return data.get("webSocketDebuggerUrl", "")
        except Exception as e:

Dynamic Request Target

Medium
Category
Server-Side Request Forgery
Confidence
60% confidence
Finding

Request target host is built from a dynamic or untrusted value. If the host is attacker-influenced, this enables SSRF to arbitrary internal or metadata endpoints.

Content

Scanner excerpt · scripts/browser_agent.py (reported line 55)May include surrounding context.

python
def get_debugger_url(self) -> str:
        """获取 WebSocket 调试器 URL"""
        try:
            resp = requests.get(f"http://{self.host}:{self.port}/json/version", timeout=5)
            data = resp.json()
            return data.get("webSocketDebuggerUrl", "")
        except Exception as e:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The evaluate method exposes arbitrary JavaScript execution in whatever page context the agent connects to. This allows manipulation of authenticated sessions, DOM scraping, token extraction, CSRF-like action triggering, and execution of untrusted operator-supplied code against live browser state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Arbitrary JavaScript execution is exposed without any confirmation, policy checks, or contextual safety controls. In this tool's context, that makes dangerous browser-side actions easy to trigger silently against active tabs and authenticated sessions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code contains natural-language docstrings, comments, log messages, and example usage text exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document explicitly promotes connecting an agent to a real Chrome session that reuses login state, cookies, and existing browser permissions, but it does not warn that automation will act as the user on authenticated accounts. In this skill context, that omission is dangerous because the surrounding content encourages remote debugging and direct browser control, which can lead to data access, account changes, or destructive actions on live services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The usage examples show navigation and click operations against a live browser without stating that these commands may execute on real logged-in sessions and cause irreversible account or data changes. Because this skill is specifically for browser automation via CDP/OpenClaw, examples are likely to be copied directly, increasing the risk of unintended actions on production accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The report normalizes browser screenshot capture and local disk storage without any warning about sensitive data exposure. In a browser-automation skill, screenshots can contain authenticated sessions, personal data, tokens, or internal pages, and saving them to predictable local paths increases the risk of unintended retention or disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The report presents JavaScript evaluation in the browser as a normal capability without warning that page-context code will execute inside the active browsing session. In this skill context, that can interact with authenticated pages, read DOM-visible data, trigger state-changing actions, or execute untrusted snippets if copied into workflows without safeguards.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The README content is entirely in Chinese and does not indicate that other languages are supported or that the locale restriction is intentional for a region-specific tool. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The package manifest uses Chinese-only natural-language description and command titles, which indicates a fixed locale presentation without any visible opt-in or alternative language support. Under the policy rule, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

All user-facing natural-language descriptions and usage instructions in the file are presented only in Chinese, with no indication that users may choose another language. This is a natural-language policy concern because it imposes a locale/language assumption without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The code writes screenshot data directly to a local path with open(..., "wb") but provides no confirmation prompt or inline warning about creating or overwriting files. Although the CLI later prints after saving, there is no advance disclosure at the point of the safety-relevant file write.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file’s human-readable comments are written only in Chinese, which can indicate a language-specific constraint without any documented user choice or opt-in. Under the policy rule for natural-language violations, forcing a specific language is reportable unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

Using an unpinned dependency range for websocket-client allows different versions to be installed over time, which can introduce vulnerable or incompatible releases into the environment without review. This weakens supply-chain integrity and reduces build reproducibility.

Content

Scanner excerpt · scripts/requirements.txt (reported line 4)May include surrounding context.

text
# Browser Agent 技能依赖

# WebSocket 客户端
websocket-client>=1.6.0

# HTTP 请求
requests>=2.31.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

Using requests>=2.31.0 without an exact pin permits installation of later versions that may have unresolved vulnerabilities or behavioral changes. Because requests is a widely used network library, version drift can expose the skill to known or future supply-chain and runtime security issues.

Content

Scanner excerpt · scripts/requirements.txt (reported line 7)May include surrounding context.

text
websocket-client>=1.6.0

# HTTP 请求
requests>=2.31.0

# 可选：异步支持
# websockets>=12.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The manifest references requests without pinning to a verifiable safe release, while the package has multiple known advisories across versions. Because the installed version is not fixed, it is impossible to determine from this file whether deployments will avoid affected releases, creating avoidable exposure in a network-facing dependency.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

At L104 the documented invocation specifies type="png", which implies a PNG screenshot should be created. However, the result at L109 shows the saved file path ending in .jpg, directly contradicting the documented behavior rather than merely omitting detail.

Content

No source excerpt is available for this finding.