ClawHub
Back to skill

Security audit

AI Browser

Security checks across malware telemetry and agentic risk

Overview

This is a real browser-control skill, but it exposes powerful unauthenticated control over a live browser and logged-in pages.

Install only if you intend to run a trusted browser-automation service and can keep its WebSocket and Chrome debugging ports inaccessible to untrusted users or networks. Avoid using it with sensitive logged-in accounts unless you accept that connected clients can read page contents, capture screenshots, collect form values, type, click, and run JavaScript in the browser.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The documented behavior includes an `evaluate` action that executes arbitrary JavaScript in the browser context, and the finding indicates additional behaviors such as visiting a specific third-party site, checking login state, attaching to an existing local Chrome debug port, and writing screenshots locally. Those capabilities go beyond a simple browser automation description and materially increase risk because they can interact with authenticated sessions, inspect user data, and perform actions on external sites without sufficiently explicit disclosure or constraints.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The `evaluate` action allows any WebSocket client to supply arbitrary JavaScript that executes in the context of the currently loaded page. This effectively grants script execution over browser sessions, enabling data extraction, DOM manipulation, action spoofing, and abuse of any authenticated web context the browser has access to.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This skill can navigate to arbitrary sites, click elements, type into forms, execute scripts, capture screenshots, and retrieve DOM content, all of which can affect external services and expose sensitive user data. The absence of strong warnings, consent requirements, and usage boundaries makes the skill more dangerous in context because browser automation can trigger real-world side effects such as account actions, data submission, or leakage of page contents.

Missing User Warnings

High
Confidence
98% confidence
Finding
Unauthenticated WebSocket commands can invoke `page.evaluate` without any confirmation, letting a remote client run arbitrary page-context code silently. In a real browser controlling logged-in sessions, this can expose sensitive data, perform unauthorized actions, and bypass the limited automation scope suggested by the skill description.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The `snapshot` action serializes `input` and `textarea` values directly, which may include passwords, personal data, tokens, drafts, or other secrets present on the page. Because this is returned over the WebSocket API without any redaction or disclosure, a client can covertly harvest user-entered data from active sessions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {
    "puppeteer": "^21.0.0",
    "ws": "^8.14.0"
  }
}
Confidence
93% confidence
Finding
"ws": "^8.14.0"

Known Vulnerable Dependency: ws==8.14.0 — 2 advisory(ies): CVE-2024-37890 (ws affected by a DoS when handling a request with many HTTP headers); CVE-2026-45736 (ws: Uninitialized memory disclosure)

High
Category
Supply Chain
Confidence
99% confidence
Finding
ws==8.14.0

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.