ClawHub
Back to skill

Security audit

Fast Browser Use 1.0.5

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is powerful and mostly coherent, but it includes under-scoped session, cookie, scraping, and browser-safety behavior that needs human review before installation.

Install only if you are comfortable giving this skill broad control over a Chrome session. Avoid using it with sensitive accounts until cookie export is protected, Chrome sandboxing remains enabled by default, loopback MCP transports require authentication, and the evasion/scraping guidance is removed or clearly restricted to authorized testing.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Installation Through an Unpinned Author-Controlled Homebrew Tap

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
src/bin/cli.rs:145
Finding

Chrome Sandbox Disabled Across All CLI Browser Workflows

Content
View full analysis
{ info!("Navigating to: {}", url); let options = LaunchOptions::default().sandbox(false); let session = BrowserSession::launch(options)?; ``` ```rust Commands::Snapshot { url, include_styles, output } => { let session = BrowserSession::launch(LaunchOptions::default().sandbox(false))?; ``` ```rust Commands::Login { url, save_session } => { info!("Opening headed browser for login at {}", url); let options = LaunchOptions::default().headless(false).sandbox(false); let session = BrowserSession::launch(options)?; ``` ```rust Commands::Harvest { url, selector, scrolls, delay, output } => { info!("🚜 Harvesting from {} (selector: {}, scrolls: {})", url, selector, scrolls); let session = BrowserSession::launch(LaunchOptions::default().sandbox(false))?; ``` ```rust Commands::Markdown { url, output } => { info!("Converting {} to markdown", url); let session = BrowserSession::launch(LaunchOptions::default().sandbox(false))?; ``` ```rust Commands::Screenshot { url, output, full_page } => { info!("📸 Screenshotting {}", url); let session = BrowserSession::launch(LaunchOptions::default().sandbox(false))?; ``` ```rust Commands::Sitemap { url, analyze_structure, max_pages, max_sitemaps, output } => { info!("🗺️ Analyzing sitemap for {}", url); let session = BrowserSession::launch(LaunchOptions::default().sandbox(false))?; ``` The secure configuration default is overridden despite sandboxing being enabled in `src/browser/config.rs:25-34`: ```rust impl Default for LaunchOptions { fn default() -> Self { Self { ...[truncated 2128 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
src/bin/cli.rs:242
Finding

Authentication Cookies Exported to Plaintext Files Without Restrictive Permissions

Content
View full analysis
, // Local storage could be added here } ``` ### Technical Analysis Browser cookies can contain bearer-style session tokens that authorize access without requiring the account password or a new multifactor-authentication challenge. The `Login` command serializes the complete browser cookie collection to JSON and writes it using the general-purpose `fs::write` API. The implementation does not: - create the file with an explicitly restrictive mode such as `0600`; - encrypt the session material; - use an operating-system credential store; - reject symbolic links or unsafe existing destinations; - warn that the output contains credentials; - prevent accidental storage inside a source repository. The session export is part of the declared functionality, but its storage protections are insufficient for the sensitivity of the data. ### Attack Path 1. A user opens the headed login workflow and authenticates to a website. 2. The CLI obtains the browser's session cookies. 3. The cookies are serialized as plaintext JSON at a user-selected path. 4. The file is created in a shared, backed-up, synchronized, or source-controlled location, or is made accessible by local permission policy. 5. Another user, process, repository reader, or backup recipient obtains the file. 6. The attacker impo ...[truncated 713 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
src/bin/mcp_server.rs:154
Finding

Unauthenticated Loopback MCP Endpoints Expose Sensitive Browser Capabilities

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (34)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The documented 'Login & Cookie Heist' workflow normalizes capturing authenticated session state to disk and replaying it later, effectively enabling session theft or unauthorized reuse. Even if presented as convenience, the wording and example directly support account access persistence outside the original interactive login context.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · src/bin/cli.rs (reported line 132)May include surrounding context.

rust
ges to analyze for structure (default: 5)
        #[arg(long, default_value = "5")]
        max_pages: usize,

        /// Maximum number of sitemaps to parse (default: 10)
        #[arg(long, default_value = "10")]
        max_sitemaps: usize,

        /// Output file (JSON)
        #[arg(long)]
        output: Option<PathBuf>,
    },
}

#[derive(Serialize, Deserialize)]
struct SessionData {
    cookies: Vec<headless_chrome::protocol::cdp::Network::Cookie>,
    // Local storage could be added here
}

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("info")).init();
    let cli = Cli::parse();

    match cli.command {
        Commands::Navigate { url, human_emulation, wait_for_selector, load_session } => {
            info!("Navigating to: {}", url);
            let options = LaunchOptions::default().sandbox(false);
            
            let session = BrowserSession::launch(optio

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · src/browser/session.rs (reported line 346)May include surrounding context.

rust
return true;
            })()
        "#;

        self.tab()?
            .evaluate(go_forward_js, false)
            .map_err(|e| BrowserError::NavigationFailed(format!("Failed to go forward: {}", e)))?;

        // Wait a moment for navigation
        std::thread::sleep(std::time::Duration::from_millis(300));

        Ok(())
    }

    /// Get cookies from the current session
    pub fn get_cookies(&self) -> Result<Vec<headless_chrome::protocol::cdp::Network::Cookie>> {
        self.tab()?
            .get_cookies()
            .map_err(|e| BrowserError::ChromeError(format!("Failed to get cookies: {}", e)))
    }

    /// Set cookies for the current session
    pub fn set_cookies(&self, cookies: Vec<CookieParam>) -> Result<()> {
        let tab = self.tab()?;
        
        for cookie in cookies {
            // Convert CookieParam to headless_chrome::protocol::cdp::Network::CookieParam
            let param = CdpCookieParam {
                name: cookie.name,

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · src/mcp/handler.rs (reported line 49)May include surrounding context.

rust
/// Get a reference to the browser session (blocking lock)
    pub(crate) fn session(&self) -> std::sync::MutexGuard<'_, BrowserSession> {
        self.session.lock().expect("Failed to lock browser session")
    }
}

impl Default for BrowserServer {
    fn default() -> Self {
        Self::new().expect("Failed to create default browser server")
    }
}

impl Drop for BrowserServer {
    fn drop(&mut self) {
        debug!("BrowserServer dropped");
    }
}

#[tool_handler]
impl ServerHandler for BrowserServer {
    fn get_info(&self) -> ServerInfo {
        ServerInfo {
            instructions: Some("Browser-use MCP Server".into()),
            capabilities: ServerCapabilities::builder().enable_tools().build(),
            ..Default::default()
        }
    }
}

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

This tool allows unconditional clearing of all localStorage for the current origin with no visible warning, scoping, or safeguard. In an agent/browser automation context, that can silently destroy session state, preferences, cached app data, or anti-CSRF/session-related client data, causing denial of service to the user workflow and potentially forcing reauthentication or state reset.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file advertises an MCP server for AI-driven automation and features such as navigation, clicking, input, screenshots, and content extraction. Those behaviors can affect user data and privacy, but the README provides no caution, disclosure, or usage warning about interacting with live sites, entering data, or capturing page contents.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares powerful browser/network functionality but does not define any explicit tool scope, permissions, or allowed-tools boundaries. In an agent environment, that omission increases the chance the skill is invoked for unrestricted web access or abusive scraping workflows without policy guardrails.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The recipe explicitly frames the capability as bypassing bot detection through human emulation, which is an evasion of anti-abuse controls rather than ordinary automation. This materially increases misuse potential for scraping protected targets and defeating site defenses.

Content

No source excerpt is available for this finding.

Ssd 2

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The phrase 'bypass bot detection via human emulation' is a direct semantic instruction to evade anti-automation protections. In a browser automation skill, this context makes the content more dangerous because it provides an operational recipe for defeating common abuse controls on protected sites.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation instructs saving authenticated session data to a local file without warning that the file may contain reusable cookies or tokens. That omission can lead users to store sensitive auth material insecurely, exposing accounts if the file is copied, checked into source control, or read by other processes.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The narrative sequence guides the user from a legitimate login to saving and later replaying authenticated state under the label 'cookie heist,' which normalizes abusive session capture. This is dangerous because it lowers the barrier to credential/session misuse and can enable persistent unauthorized access if the session file is shared or stolen.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The harvesting examples encourage broad extraction from infinite-scroll pages and named social/content platforms without discussing authorization, privacy, or site-policy constraints. In context, that omission makes misuse for mass scraping or collection of personal/content data more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The Navigate command reads cookies from disk and injects them into a live browser session without any trust check, validation, or user warning. This enables reuse of sensitive authenticated sessions from local files, which can lead to account/session takeover if the cookie file is stolen, shared, or loaded from an untrusted source.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The Login command serializes browser cookies and writes them to an arbitrary file path in cleartext. Cookies often represent authenticated session state, so anyone who can read that file may be able to hijack the user's logged-in browser session for the associated sites.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · src/bin/mcp_server.rs (reported line 175)May include surrounding context.

rust
});

            // Start HTTP server with SSE router
            let listener = tokio::net::TcpListener::bind(&bind_addr).await?;
            axum::serve(listener, router.into_make_service()).await?;
        }
        Transport::Http => {

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

The HTTP transport uses a LocalSessionManager for streamable MCP sessions, which introduces session persistence/state retention across requests. In a browser automation server, retained session state can expose authenticated browser context, cookies, or prior client activity to later requests if session boundaries are weak or reused improperly. The risk is moderated because the listener is bound only to 127.0.0.1, but local untrusted processes could still interact with it.

Content

Scanner excerpt · src/bin/mcp_server.rs (reported line 197)May include surrounding context.

rust
info!("Ready to accept MCP connections at http://{}{}", bind_addr, cli.http_path);

            let listener = tokio::net::TcpListener::bind(bind_addr).await?;
            axum::serve(listener, router).await?;
        }
    }

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The tab listener captures all page-generated console output and stores it centrally without any notice or minimization. Console logs often contain debugging data, tokens, PII, application state, or error details, so silent collection increases the risk of sensitive data exposure through the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code explicitly disables Chrome's normal automation indicators by removing --enable-automation and adding --disable-blink-features=AutomationControlled. In a generic browser automation skill, this is anti-detection behavior that can facilitate stealthy scraping, policy evasion, or interacting with sites under false pretenses, increasing abuse potential beyond normal automation needs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The session can set arbitrary cookies directly into the active browser context without any confirmation, provenance check, or policy restriction. This can alter authentication state, impersonate users, bypass normal login flows, or inject tracking/session data into sites the agent visits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The extractor intentionally serializes sensitive page data, including textbox contents and link targets, into a JSON structure for downstream AI consumption. In an agent/browser skill context, this can expose secrets such as passwords, personal data, tokens in URLs, search queries, or internal links without minimization, redaction, or user-consent controls, making data exfiltration materially more dangerous than a normal accessibility snapshot.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The tool description states that it can capture a screenshot of the current page, which may include sensitive on-screen data. In this file there is no confirmation prompt, warning text, or privacy disclosure associated with that capture operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The tool description explicitly exposes arbitrary JavaScript execution in the browser context, which is a safety-sensitive capability because it can alter page state and interact with user data. This file does not show any confirmation, cautionary description, or other disclosure about the risks of executing code in the page.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The tool writes an annotated screenshot to a caller-controlled filesystem path with no validation, restriction to a safe directory, or confirmation step. In an agent/skill context, this enables arbitrary file write within the process's permissions, which can overwrite user files, place sensitive screenshots in unexpected locations, or aid follow-on attacks if the path targets configuration or startup-loaded files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The tool returns a success message claiming the browser was closed, while the surrounding comment indicates the implementation may only close tabs as a proxy. This can mislead higher-level agents or workflows into believing browser state was fully terminated when session resources, cookies, or background processes may still remain active.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This tool exposes direct cookie read and write capabilities through get_cookies and set_cookies without any visible consent checks, scope restrictions, or user-facing disclosure. In an agent/browser automation context, cookies can contain session identifiers and authentication state, so silent access or modification can enable account hijacking, impersonation, or cross-site session manipulation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
src/tools/convert_to_markdown.js:22