Security audit
Security checks for vulnerabilities and agentic risk
The skill is purpose-aligned, but it can send local files to arbitrary web pages without built-in confirmation or destination limits.
Review before installing. Use this only when the agent will be given an explicit destination page and exact file path, and require confirmation before any upload. Avoid using it for secrets, credentials, private documents, or untrusted sites unless you add allowlists and sensitive-file checks.
The skill invokes shell-capable commands such as agent-browser ... and python scripts/upload_file.py but does not declare any permissions or allowed-tools scope. That omission weakens policy enforcement and makes it easier for the skill to be executed with broader-than-intended capabilities, especially because it handles local file paths and browser-driven data transfer.
The metadata says the skill 'MUST be used for any browser file upload task,' which is an overly broad activation condition with no exclusions for sensitive environments, untrusted sites, or high-risk file types. Because the skill automates local-file transfer to arbitrary web pages, broad triggering increases the chance of unintended or unsafe use in contexts where explicit user confirmation and policy checks are necessary.
The skill's purpose is to upload local files to web pages, yet it provides no privacy, consent, or data-handling warning. In this context, that is dangerous because uploads are irreversible data transfers to potentially untrusted destinations, and the skill even emphasizes reliability and mandatory execution, which could normalize exfiltration of sensitive local files without adequate user awareness.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"""
for i in range(retry):
try:
result = subprocess.run(
cmd,
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
print(result.stderr)
if wait_ms > 0:
subprocess.run(["agent-browser", "wait", str(wait_ms)])
except Exception as e:
print(f"[Exception] {e}")
The script uploads a local file path to an arbitrary user-supplied URL with no origin allowlist, trust check, or user confirmation. In an agent setting, this can exfiltrate sensitive local or workspace files to attacker-controlled sites if the URL or file path is influenced by untrusted input.
The skill's stated purpose is browser-based file upload automation, but resolve_path reads OPENCLAW_WORKSPACE from the environment to rewrite input paths. Accessing environment configuration is not obviously required by the manifest description, which only mentions upload protocol and path normalization, and introduces a capability beyond direct browser automation.
The trigger strategy includes hard-coded Chinese UI labels such as "选择文件" and "上传" alongside English labels, but there is no documented language selection or locale handling policy. This can indicate implicit locale assumptions in the skill's natural-language behavior without explicit user opt-in.
No suspicious patterns detected.