ClawHub
Back to skill

Security audit

Chrome Remote Browser Guide

Security checks for vulnerabilities and agentic risk

Overview

This is a browser-control guide, but it under-discloses sensitive risks from authenticated sessions, externally hosted screenshots, and arbitrary page JavaScript.

Review before installing. This skill is not malicious, but using it can expose anything visible or script-readable in your logged-in Chrome session. Use it only on pages you intend the agent to inspect, avoid sensitive account/security/billing pages unless necessary, and treat screenshot URLs and JavaScript extraction results as potentially private data.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:56
Finding

Unconditional External Screenshot Handling May Expose Authenticated Session Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8, 56, 95, and 285
Vulnerability Type: Sensitive information exposure through externally hosted browser screenshots
Risk Level: High

Vulnerable Code Snippets

SKILL.md:8

text
A comprehensive guide for AI agents on how to control Chrome via Remote Debugging Protocol (CDP) on port 9222. This enables interaction with authenticated sessions (Google, GitHub, dashboards, etc.) without needing separate login credentials.

SKILL.md:56

text
**Golden rule**: Always take a **screenshot** and/or **snapshot** before and after every action. This is how you "see" and "understand" the page.

SKILL.md:95

text
Returns: A CDN URL of the screenshot image that you can view.

SKILL.md:285

text
### Rule 2: ALWAYS Screenshot After State Changes

Technical Analysis

The Skill is explicitly designed to operate browser sessions that are already authenticated to services such as Google, GitHub, and private dashboards. It also establishes a blanket rule that screenshots should be captured before and after actions and states that the resulting image is made available through a CDN URL.

Consequently, pages containing confidential account information may be captured and transferred to externally hosted screenshot infrastructure. The instructions do not define safeguards for:

  • Avoiding screenshots of passwords, authentication tokens, payment details, personal data, private source code, or administrative dashboards.
  • Redacting sensitive portions of an image before external transmission.
  • Obtaining explicit user approval before uploading authenticated page content.
  • Restricting access to the resulting CDN URL.
  • Defining screenshot encryption, expiration, retention, or deletion policies.
  • Preferring local accessibility snapshots when visual capture is unnecessary.

Repeated screenshots are not the minimum privilege required for browser automation. Accessibility snapshots ...[truncated 2173 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the unconditional screenshot requirement with a task-specific, opt-in policy.
  2. Prefer accessibility snapshots or narrowly scoped DOM extraction when visual evidence is unnecessary.
  3. Require explicit user approval before transmitting screenshots of authenticated pages to external infrastructure.
  4. Prohibit screenshots while passwords, tokens, recovery codes, payment information, identity records, secret-management interfaces, or similarly sensitive data are visible.
  5. Add automatic redaction for sensitive fields and page regions before any upload.
  6. Keep screenshots local by default. If external hosting is necessary, document the service destination and require authenticated access, encryption in transit and at rest, short-lived URLs, minimal retention, and reliable deletion.
  7. Limit screenshot frequency to specific verification points rather than capturing images before and after every action.
  8. Restrict arbitrary JavaScript extraction to data explicitly requested by the user and trusted origins.
  9. Clearly notify users that an authenticated page may be captured and externally hosted, including what data will be captured and how long it will remain available.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly promotes use of Chrome remote debugging for authenticated sessions and login-gated pages, but it does not warn that the agent may access highly sensitive data already present in the user's browser session. In this context, omission of a consent/privacy warning is security-relevant because the capability materially expands access to emails, dashboards, tokens, billing data, and other session-bound content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs agents to take screenshots, optionally save them to disk, and notes that screenshots are returned via a CDN URL, yet provides no warning that screenshots may contain credentials, personal data, account information, or proprietary business content. Because screenshots are a full-fidelity capture of authenticated pages, storage and external URL exposure increase the risk of unintended disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents arbitrary JavaScript execution in the page context as a normal extraction mechanism without warning that scripts can read sensitive DOM data, invoke authenticated application actions, alter page state, or trigger destructive side effects. In a browser attached to a logged-in session, this is especially dangerous because the code runs with the same effective privileges as the user on that site.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.