ClawHub
Back to skill

Security audit

Tandem Browser

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Tandem Browser control helper, but it exposes very powerful browser debugging and network-inspection capabilities without enough scoping guidance.

Install only if you trust Tandem Browser, mcporter, and the agents that will use this skill. Keep the Tandem API token private, avoid granting global or permanent trust casually, prefer isolated sessions for risky sites, and supervise any use of network logs, HAR capture, DevTools/CDP commands, authenticated pages, forms, account changes, or public posting.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill explicitly advertises `tandem_network_*` network inspection/HAR capture and `tandem_devtools_send` CDP debug bridge capabilities, which materially expand access beyond normal co-browsing into low-level traffic interception and browser debugging. In the context of a shared browser tied to the user's local profile, these features could expose sensitive headers, cookies, auth tokens, request bodies, and permit powerful browser control primitives if invoked by an agent.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.