Browser Extension Enabler

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:46 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent goal, but it should be reviewed because its mouse-control implementation is missing and it depends on an unpinned native mouse-control skill.

Review this before installing. Only use it if you trust the exact win-mouse-native dependency being installed, can read the Chinese instructions and safety notes, and are comfortable with an agent moving and clicking your real mouse. The publisher should include the missing PowerShell script and pin or verify the native mouse-control dependency before this is treated as low risk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: _meta.json:9

Finding

Unpinned Native Mouse-Control Dependency

Content

View full analysis

Vulnerability Details

File Location: _meta.json:9-12; also referenced in SKILL.md:11-12 and SKILL.md:27-30
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

json

"requires": {
  "skills": ["win-mouse-native"],
  "bins": ["powershell"]
}

The installation documentation additionally instructs users to retrieve the dependency by name:

bash

clawhub install win-mouse-native

Technical Analysis

The package depends on win-mouse-native without specifying an immutable version, cryptographic digest, verified publisher, or trusted source. Consequently, the dependency resolved during installation may differ from the version reviewed or tested by the package author.

This dependency is security-sensitive because its documented purpose is native mouse control. A compromised, replaced, or otherwise malicious release could perform arbitrary mouse movements and clicks in the current desktop session. The supplied artifact does not contain the dependency implementation, so its behavior and integrity cannot be independently verified as part of this audit.

Attack Path

1. An attacker compromises the dependency publisher, distribution channel, or package name.
2. The attacker publishes a modified release under the win-mouse-native dependency name.
3. A user follows the documented clawhub install win-mouse-native command.
4. The package manager resolves and installs the attacker-controlled release because no immutable version or digest is required.
5. When invoked, the dependency performs unauthorized desktop interactions under the user's active session.

Impact Assessment

Successful exploitation would grant the malicious dependency the ability to control mouse input with the privileges of the current interactive user. Depending on the visible applications and desktop state, it could click unintended controls, approve prompts that do no ...[truncated 306 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin win-mouse-native to a specific, audited version.
2. Require and verify a cryptographic digest or signed package manifest before installation.
3. Identify the expected publisher and trusted registry explicitly.
4. Document a reproducible dependency verification procedure.
5. Audit the exact dependency release before publishing this skill.
6. Restrict dependency use to the minimum required operations and provide a non-interactive or confirmation-gated mode where possible.
7. Fail closed if the installed dependency version or digest does not match the approved value.

other

Note

• Location: PUBLISH.md:11

Finding

Referenced PowerShell Implementation Is Missing from the Package

Content

View full analysis

Vulnerability Details

File Location: PUBLISH.md:11-17; execution references also appear in SKILL.md:37-40 and SKILL.md:51-58
Vulnerability Type: Incomplete package and unverifiable implementation
Risk Level: Low

Affected Documentation:

text

browser-extension-enabler/
├── SKILL.md                           # Skill documentation
├── _meta.json                         # Metadata
└── scripts/
    └── enable-browser-extension.ps1   # Main script

The documented execution command references the absent file:

powershell

.\enable-browser-extension.ps1

Technical Analysis

The supplied artifact contains only PUBLISH.md, SKILL.md, and _meta.json. It does not contain the documented scripts/enable-browser-extension.ps1 implementation.

As a result, the claimed behavior—including Browser Relay detection, Chrome activation, mouse movement, clicking, retry handling, and test mode—cannot be reviewed or verified. The package documentation also states that these functions passed testing, but the implementation needed to substantiate those claims is absent.

This is primarily a packaging integrity and auditability issue rather than evidence of embedded malicious code. No malicious PowerShell payload was present in the reviewed artifact.

Attack Path

1. A user installs or receives the incomplete artifact expecting the documented PowerShell script.
2. Execution fails because the referenced script is absent.
3. The user or deployment operator may attempt to obtain a replacement implementation from another source.
4. If that replacement is not authenticated and independently audited, an attacker-controlled script could be executed with the user's PowerShell privileges.

The fourth step is conditional user behavior; the reviewed files do not directly instruct users to download the missing script from an external URL.

Impact Assessment

The directly confirmed impact is lo ...[truncated 369 chars]

Remediation

View remediation

Remediation Suggestions

1. Include scripts/enable-browser-extension.ps1 in the published artifact.
2. Add the script and its cryptographic digest to a signed package manifest.
3. Ensure the package build fails when files referenced by documentation or metadata are absent.
4. Add automated tests for connection detection, Chrome activation, coordinate validation, test mode, retry limits, and failure handling.
5. Review the PowerShell implementation for command injection, unsafe process invocation, input validation errors, and unintended mouse actions before release.
6. If the script is intentionally excluded, remove the execution instructions and all claims that its behavior has been tested.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document instructs users to run a script that can activate Chrome and perform native mouse movement/clicks to enable an extension, but it does not prominently warn that UI automation will directly manipulate the local desktop. Even though this is publication/testing documentation rather than executable code, undisclosed input simulation can cause unintended clicks, interfere with user activity, or be repurposed in a broader attack chain if users run it without understanding the behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill README is written almost entirely in Chinese, including usage, configuration, workflow, testing, troubleshooting, and safety guidance. There is no indication that the skill is region-specific or that users can choose another language, which creates a language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The file header and most operational guidance are presented in Chinese, while the skill name remains in English. Under the policy criteria, forcing a specific language without offering an alternative or documenting the locale scope can be a natural-language policy issue.

Content

No source excerpt is available for this finding.