ClawHub
Back to skill

Security audit

自我智能改进体

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate browser automation skill, but it gives agents powerful access to logged-in browser sessions and relies on an unpinned external CLI with unclear provenance metadata.

Install only after confirming the agent-browser package and upstream source are the ones you intend to trust, preferably pinning a version. Use it only on sites and accounts where automation is authorized, supervise actions that submit or change data, and treat saved state files, cookies, storage values, screenshots, PDFs, and network captures as sensitive credentials or private data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The manifest description frames the skill as a browser automation tool but omits materially sensitive capabilities documented later in the file, including screenshots/PDF export, network interception/mocking, and direct access to cookies and storage. That incomplete disclosure can cause an agent or operator to invoke the skill under a lower-risk mental model than warranted, increasing the chance of unsafe use with sensitive sessions or data.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documented state save/load workflow enables persistence and reuse of browser authentication state, which commonly includes cookies and other session artifacts that can grant account access if copied or mishandled. Without any warning, retention guidance, or scope restrictions, users or downstream agents may store auth bundles insecurely, exfiltrate them, or replay them across contexts.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Exposing commands to read and set cookies and localStorage without any warning materially increases the risk of credential theft, session hijacking, CSRF token extraction, and unauthorized manipulation of application state. In an agent-oriented skill, this is more dangerous because automated workflows may access sensitive browser data at scale or relay it into logs, tool outputs, or subsequent prompts.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.