ClawHub
Back to skill

Security audit

Use Browser (Scrape leads, like, post on socials or perform actions on the web)

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly malicious, but it gives an agent broad control over authenticated social media accounts without enough confirmation for public actions, outreach, scraping, or cookie handling.

Install only if you are comfortable with an agent acting inside authenticated social media accounts. Before using it, require explicit previews and confirmations for posts, DMs, connection requests, engagement, scraping/export jobs, and all cookie commands; avoid high-value accounts and do not let exported cookies remain on disk.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:231
Finding

Authenticated Session Cookies Can Be Read and Exported

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 231–245
Vulnerability Type: Authentication cookie exposure and insecure credential export
Risk Level: Medium

Vulnerable Code

bash
browser-use cookies get                       # Get all cookies for current session
browser-use cookies get --url https://instagram.com  # Cookies for specific platform
browser-use cookies set <name> <value>        # Set a cookie
browser-use cookies set name val --domain .instagram.com --secure --http-only
browser-use cookies clear --url <url>         # Clear cookies for specific URL
browser-use cookies export <file>             # Export cookies to JSON
browser-use cookies import <file>             # Import cookies from JSON
text
**Cookie rules:**
- Cookie export files should be stored in `~/.browseruse/cookies/`, not in `/tmp/` or world-readable locations
- After importing cookies, delete the export file: `rm <file>`
- Never export cookies from one platform and import them into a different platform's session
- If a session expires, inform the user so they can re-authenticate manually

Technical Analysis

The Skill permits the agent to retrieve authentication cookies into command output and export them as JSON to a caller-selected file. Social-media session cookies are bearer credentials: possession may be sufficient to impersonate the authenticated user without knowing the account password.

The documented storage guidance does not technically enforce a fixed destination, restrictive file permissions, encryption, redaction from model context or logs, user confirmation, or automatic deletion. The deletion instruction applies only after an import, so an export created for another reason may remain on disk indefinitely. These capabilities are also unnecessary for most documented workflows, which can rely on browser-managed persistent sessions.

Attack Path

...[truncated 1329 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove cookies get, cookies export, and cookies import from the normal Skill interface when browser-managed session persistence is sufficient.
  2. Require explicit, operation-specific user confirmation before reading, exporting, importing, setting, or clearing cookies.
  3. Never return raw cookie values to the model context, terminal history, telemetry, or ordinary application logs.
  4. If export is indispensable, enforce a fixed private directory rather than accepting arbitrary output paths.
  5. Create export files atomically with owner-only permissions such as mode 0600, reject symbolic links, and verify directory ownership and permissions.
  6. Encrypt exported credentials at rest using a user-controlled secret or operating-system credential store.
  7. Automatically delete exports immediately after the authorized operation, including failure and cancellation paths.
  8. Restrict exports to the minimum required domains and cookie fields, and prevent transfer between accounts, platforms, or sessions.
  9. Record security events without recording cookie names or values, and provide a session-revocation procedure for suspected exposure.
  10. Treat cookie clear/import operations as account-impacting actions that require confirmation and post-operation verification.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly supports lead scraping and profile data extraction from social platforms but does not include guardrails for privacy, consent, data minimization, retention, or legal/terms-of-service constraints. In a social-media automation context, this creates a realistic risk of collecting personal data at scale without user awareness of compliance obligations, making misuse easier even if the author’s intent appears operational rather than malicious.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill allows the agent to send DMs, connection requests, likes, comments, and publish posts without requiring an explicit user warning that these actions create external account activity under the user’s authenticated identity. Because the VM reuses pre-authenticated sessions, mistaken, injected, or over-broad instructions can directly affect third-party accounts and recipients, causing reputational, legal, or platform-enforcement harm.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
96% confidence
Finding

Granting 'high autonomy' and marking posting, DMs, connection requests, engagement, and scraping as actions the agent may perform freely is unsafe in this context. Even though destructive actions require confirmation, many non-destructive actions are still externally consequential and can be abused by prompt injection, user misunderstanding, or task misinterpretation to perform large-scale account activity or data collection.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
The agent operates with **high autonomy** for standard social media tasks, but MUST pause and confirm with the user before destructive or irreversible actions.

### ✅ Act Freely (No Confirmation Needed)

- Posting and publishing content (text, images, stories)
- Sending DMs and connection requests

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.

text

**Cookie rules:**
- Cookie export files should be stored in `~/.browseruse/cookies/`, not in `/tmp/` or world-readable locations
- After importing cookies, delete the export file: `rm <file>`
- Never export cookies from one platform and import them into a different platform's session
- If a session expires, inform the user so they can re-authenticate manually