ClawHub
Back to skill

Security audit

Chrome Automation

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is mostly coherent, but it promotes anti-bot evasion and can expose credentials while running unsafe browser and install steps.

Review this skill carefully before installing. Use it only for websites and accounts you are authorized to automate, avoid entering real passwords or cookies, do not run it as root, and prefer pinned dependencies plus a sandboxed browser/container. Treat its form automation as capable of changing account or site state.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/playwright_stealth.py:25
Finding

Chromium Sandbox Disabled While Loading Arbitrary URLs

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned Playwright and Browser Artifact Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/playwright_stealth.py:109
Finding

Form Values and Login Credentials Written to Plaintext Logs

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill description explicitly advertises bypassing anti-bot detection, which is a strong abuse signal rather than a neutral automation feature. In context, this materially increases risk because it frames the skill for stealthy interaction with third-party services, enabling evasion of access controls and platform safeguards.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
84% confidence
Finding

The chained privileged command combines update and install in a single shell line, which reduces reviewability and encourages copy-paste execution of compound root actions. This becomes more dangerous in an install recipe that also downloads external software, because failures or unexpected substitutions can be harder for users to detect and safely recover from.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
command: |
          # 下载并安装Google Chrome
          wget -q https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb -O /tmp/chrome.deb
          sudo apt update && sudo apt install -y /tmp/chrome.deb xvfb
        label: Install Google Chrome
      - id: playwright-env
        kind: shell

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The Playwright section reiterates stealth usage for bypassing anti-bot detection as a routine feature, not as a narrowly scoped testing capability. That makes the guidance more dangerous because it operationalizes evasion in normal workflows such as login and posting on external sites.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The install steps download and install software via shell with elevated privileges but provide no integrity verification, trust warning, or least-privilege guidance. This is dangerous because users may execute privileged commands from the skill verbatim, expanding the blast radius if the package source, network path, or installation flow is compromised.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
91% confidence
Finding

The skill instructs users to run sudo package installation commands directly from the skill content. While admin installation can be legitimate, presenting privileged commands without safety notes or verification guidance is risky because it encourages blind elevation and broad system modification.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
command: |
          # 下载并安装Google Chrome
          wget -q https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb -O /tmp/chrome.deb
          sudo apt update && sudo apt install -y /tmp/chrome.deb xvfb
        label: Install Google Chrome
      - id: playwright-env
        kind: shell

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
90% confidence
Finding

This step again uses sudo for environment setup, increasing the chance of unnecessary root-level changes for a workflow that is otherwise largely user-space. In context, repeated privilege escalation normalizes unsafe execution habits and can magnify harm from mistakes or dependency compromise.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
kind: shell
        command: |
          # 创建Python虚拟环境并安装Playwright
          sudo apt install -y python3.11-venv
          python3 -m venv ~/.playwright-env
          source ~/.playwright-env/bin/activate
          pip install playwright

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill promotes automatic login, form filling, and mentions using logged-in cookies, but does not warn about credential handling, cookie theft/reuse, account lockout, or abuse risks. In this context, the automation targets real consumer platforms, which increases the chance that users will apply it to sensitive accounts without adequate safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The function can automatically click a submit control after filling arbitrary fields, which can cause external state changes such as account actions, purchases, or form submissions without any explicit user confirmation at the time of execution. In this skill’s context, the stated goal includes automated login and bypassing anti-bot detection, which increases the likelihood of unattended interaction with third-party sites and makes silent submission more risky.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The browser context forces a Chinese locale and Shanghai timezone for all runs. This is a natural-language policy concern because it imposes a specific language/locale setting without offering the user a choice or documenting a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.