ClawHub
Back to skill

Security audit

Windows Browser Ops

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed remote browser-automation helper, but it gives broad authenticated desktop authority and exports screenshots or download archives without enough scoping or user-control safeguards.

Review before installing. Use only on an isolated Desktop/browser profile, avoid preexisting logged-in accounts unless explicitly required, capture only the target browser window, archive only files produced for the current task, and require a visible manifest or preview before anything is uploaded to Discord or another requester.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:20
Finding

Overbroad Collection and External Upload of the Downloads Directory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:20-21, SKILL.md:50-54, and references/edge_playbook.md:23-26
Vulnerability Type: Overbroad local file access and external data disclosure
Risk Level: High

Evidence

SKILL.md:20-21:

markdown
| Open a webpage and capture a screenshot | 1) `launch_edge.ps1 -Url <URL>` 2) `focus_edge.ps1` 3) `capture_screenshot.ps1 -Output <path>` 4) Upload the screenshot to the requester |
| Download and package files | 1) Navigate and start the download 2) Wait for `.crdownload` files to disappear 3) `download_and_zip.ps1 -SourcePath "C:\\Users\\<USER>\\Downloads" -ZipPath %TEMP%\\edge-export.zip` 4) Upload the ZIP archive |

SKILL.md:50-54:

markdown
### 4. Organize Downloads
1. Poll `Downloads` until all `.crdownload` files have disappeared.
2. Run `download_and_zip.ps1 -SourcePath <download directory> -ZipPath %TEMP%\\edge-export.zip`.
3. Upload the ZIP archive and describe its contents and timestamp in the response.

references/edge_playbook.md:23-26:

markdown
## Package Downloaded Files
1. Wait for downloads to finish by polling until `.crdownload` files disappear from the `Downloads` directory.
2. Run `download_and_zip.ps1 -SourcePath "C:\Users\<USER>\Downloads" -ZipPath "$env:TEMP\\edge-export.zip"`.
3. Upload the ZIP archive. Files may optionally be filtered by recent modification time to avoid including older files.

Technical Analysis

The documented default workflow passes the user's entire Downloads directory to an archive operation and then uploads the resulting archive. The workflow does not require a dedicated task directory, a manifest of files generated by the current operation, canonical-path validation, or explicit approval of each file before transmission.

Filtering by modification time is only presented as an optional measure. Modification time alone would also be an insuffic ...[truncated 1655 chars]

Remediation
View remediation

Remediation Suggestions

  1. Create a new, randomly named directory for every task and configure the browser to download only into that directory.
  2. Record the expected filename, download identifier, start time, final canonical path, and file hash.
  3. Archive only explicitly identified files generated by the current task; never use the user's general Downloads directory as the archive source.
  4. Resolve canonical paths and reject symlinks, junctions, reparse points, path traversal, and files outside the task directory.
  5. Generate and display an archive manifest containing filenames, sizes, hashes, and MIME types before upload.
  6. Require explicit user confirmation of the manifest before transmitting the archive externally.
  7. Enforce file-count and archive-size limits and reject sensitive file types unless specifically requested.
  8. Delete the isolated task directory and archive after confirmed delivery according to a documented retention policy.
  9. Include the actual PowerShell scripts in the package so their filtering, path handling, and archive behavior can be audited.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:47
Finding

Full-Screen Evidence Capture Can Disclose Unrelated Desktop Content

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:47 and references/edge_playbook.md:17-20
Vulnerability Type: Excessive screenshot scope and external information disclosure
Risk Level: High

Evidence

SKILL.md:47:

markdown
- `capture_screenshot.ps1 -Output %TEMP%\\edge-shot.png` captures the full screen. Modify the script to capture a specific window only when necessary.

references/edge_playbook.md:17-20:

markdown
## Screenshots and Evidence
1. Use `Graphics.CopyFromScreen` to capture the full screen through `capture_screenshot.ps1`.
2. To capture only the browser window, the script may be modified to obtain the Edge window rectangle using `[System.Windows.Forms.Screen]::AllScreens` and `Get-Process msedge`.
3. Return the file using `openclaw message send --channel discord ... --file path`.

Technical Analysis

The Skill is intended to collect browser evidence, but its default procedure captures the entire screen. Restricting capture to the Edge window is merely an optional future modification. Full-screen capture exceeds the scope necessary for browser automation and may include other applications, desktop files, notifications, messaging windows, credentials, authentication prompts, or content displayed on additional desktop surfaces.

The workflow then directs the agent to transmit the image through Discord. No preview, redaction, active-window verification, destination validation, or user-confirmation requirement is defined. Lock-screen guidance addresses screenshot availability but does not mitigate disclosure.

Attack Path

  1. Sensitive information is visible elsewhere on the Desktop, such as in another application, a notification, or an authentication prompt.
  2. A requester asks the agent to capture evidence of a browser page.
  3. The agent invokes the documented capture_screenshot.ps1 workflow.
  4. Graphics.CopyFromScreen captures the full desktop rather than ...[truncated 726 chars]
Remediation
View remediation

Remediation Suggestions

  1. Make browser-window-only capture the mandatory default.
  2. Resolve and validate the target Edge process and window handle immediately before capture.
  3. Capture only the target window's client area and fail closed if the expected window cannot be identified.
  4. Do not fall back automatically to full-screen capture.
  5. Use a dedicated virtual desktop or isolated browser environment with notifications disabled.
  6. Display a local preview and require confirmation before external transmission.
  7. Add automated redaction for password fields, account identifiers, notifications, and other sensitive regions.
  8. Validate the destination channel and requester identity before upload.
  9. Store screenshots in a per-task directory with restrictive permissions and delete them after delivery.
  10. Include and audit the referenced screenshot script rather than instructing operators to modify an unavailable script.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:27
Finding

Unrestricted Custom PowerShell and Browser Automation on an Authenticated Desktop

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:27-33 and SKILL.md:43-45
Vulnerability Type: Unrestricted local command execution and authenticated-session abuse
Risk Level: High

Evidence

SKILL.md:27-33:

markdown
1. **Identify the category**:
   - For opening or screenshots only, use the navigation and evidence route.
   - For form completion or button clicks, additionally use UIAutomation or JavaScript injection.
   - For downloads, add download monitoring and packaging.
2. **Prepare the environment**: If Edge is not running, call `launch_edge.ps1`, followed by `focus_edge.ps1`.
3. **Perform the action**: Select a script or custom PowerShell according to the request.
4. **Collect and return evidence**: Capture screenshots, save logs, package downloads, and upload them.

SKILL.md:43-45:

markdown
### 2. Navigation and Interaction
- `edge_nav.ps1 -Url <target>`: The current version navigates by reopening Edge and may later be replaced with UIAutomation or DevTools.
- For complex interaction, use PowerShell `Add-Type -AssemblyName UIAutomationClient` to obtain controls; see the examples in `references/edge_playbook.md`.

Technical Analysis

The instructions authorize the agent to select and execute custom PowerShell according to a request, as well as to use UIAutomation or JavaScript injection for browser interactions. The prerequisite environment includes an approved Desktop node and may contain an Edge session already authenticated to target accounts.

No command allowlist, URL or origin policy, argument validation, constrained execution environment, confirmation boundary, or prohibition on sensitive account actions is documented. Custom PowerShell is not inherently restricted to browser operations and executes with the Desktop user's permissions. UIAutomation can interact with browser and operating-system dialogs, while injected JavaScript can read or alter page co ...[truncated 1927 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove authorization for arbitrary or custom PowerShell from the Skill.
  2. Permit only versioned, packaged, cryptographically verified, and audited scripts with narrowly defined parameters.
  3. Use PowerShell Constrained Language Mode, a restricted service account, and an execution policy enforced through application control rather than relying only on RemoteSigned.
  4. Validate URLs against an explicit scheme and origin policy; permit only https destinations approved for the task.
  5. Reject shell metacharacters and bind parameters without constructing command strings.
  6. Prohibit arbitrary JavaScript injection. If page scripting is required, expose narrowly scoped, reviewed automation actions.
  7. Run browser tasks in an isolated profile without preexisting authenticated sessions unless authentication is explicitly required and approved.
  8. Require confirmation immediately before form submission, purchases, account changes, file uploads, downloads, authentication actions, and external transmission.
  9. Restrict UIAutomation to the validated Edge process and expected window; prevent interaction with system dialogs and unrelated applications.
  10. Apply filesystem, network, process, and destination allowlists to the Desktop execution environment.
  11. Log the exact command, normalized arguments, target process, origin, files accessed, and resulting external destination.
  12. Add the missing scripts/ directory to the package and perform a separate source audit before allowing execution.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The playbook instructs operators to capture full-screen screenshots and transmit them externally, which can expose unrelated sensitive data such as emails, chats, credentials, tokens, or other application windows visible on the desktop. In the context of a remote browser-ops skill that explicitly returns evidence to Discord or another external channel, this creates a concrete data-exfiltration risk.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This section plainly describes collecting browser-adjacent artifacts—screenshots and downloaded files—and sending them to an external channel. In a skill designed for remote desktop browser control, these instructions materially increase the likelihood of surveillance and data exfiltration, especially because there are no stated safeguards around consent, minimization, or destination trust.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The instructions package the Downloads directory into a ZIP and upload it externally, which can easily include personal documents, secrets, installers, exports, or unrelated files beyond the intended task. Even with a note about filtering by modification time, the behavior still enables bulk collection and exfiltration of user data without safeguards, minimization, or consent controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The prerequisites require Edge to be logged into the target account and the RDP session to remain unlocked so UI automation and screenshots work, but the skill does not warn about the security implications of acting inside an authenticated browser session. In this context, the skill enables an operator to perform actions and collect data with the victim user's live privileges, substantially increasing the risk of account abuse, privacy violations, and unauthorized transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs operators to upload screenshots and downloaded ZIP archives as evidence, but provides no consent, minimization, or privacy warning. Because the skill is designed for remote control of a logged-in browser session, those artifacts may contain credentials, personal data, session information, or sensitive documents, making exfiltration easy and likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file contains the core workflow steps entirely in Chinese, including operational instructions and labels, but does not provide an English alternative, opt-in language selection, or any explanation that the skill is intended only for a Chinese-speaking context. That creates a natural-language policy concern because it imposes a specific language on users or operators without documented choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The skill description is written as an instruction in Chinese and does not indicate any language choice or opt-in, which can be a language/locale policy issue if the organization expects user-facing behavior to respect user preference. There is no documented justification that this skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest describes remote browser operation for actions like opening webpages, interaction, screenshot capture, and packaging downloads with evidence return. Line L11 adds a separate browser-state modification capability—clearing Edge browsing data/cache—which is not described as part of that operational scope and changes local browser state beyond what is necessary to perform the listed tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.