ClawHub
Back to skill

Security audit

wang

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is coherent and not deceptive, but it needs review because it grants broad browser/session access and recommends saved auth state and unpinned global installation without clear safety guidance.

Review before installing. Use only with sites and accounts you are authorized to automate, avoid production or highly sensitive sessions where possible, treat saved state files, screenshots, traces, recordings, cookies, and storage dumps as secrets, and prefer a pinned, local installation of agent-browser over an unpinned global npm install.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis
Remediation
View remediation
``` 2. Record and verify package integrity information through a lockfile, trusted checksum, package signature, or equivalent reproducible verification mechanism. 3. Prefer a project-local installation over a global installation so the dependency is isolated and its version is controlled: ```bash npm install --save-exact agent-browser@ npx agent-browser ``` 4. Review the selected package release, including its lifecycle scripts and transitive dependencies, before updating the pinned version. 5. Avoid recommending `@latest` in troubleshooting documentation. Provide a documented upgrade process that requires security review and compatibility testing. 6. Run installation without elevated privileges and in a sandboxed or otherwise restricted environment where practical. 7. Keep the root and nested copies synchronized so remediated installation guidance is applied consistently to both copies. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · openclaw skills/CONTRIBUTING.md (reported line 60)May include surrounding context.

md
## Adding New Commands to the Skill

Update SKILL.md when the upstream CLI adds new commands.
- Keep the Installation section
- Add new commands in the correct category
- Include usage examples

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill exposes capabilities for screenshots, video recording, request inspection, and direct access to cookies and localStorage without any privacy or data-handling warning. In an agent setting, these features can capture credentials, personal data, tokens, and internal application content, increasing the risk of inadvertent collection or disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly recommends saving and reloading authenticated browser state (auth.json) but does not warn that these files can contain reusable session cookies and other authentication artifacts. If an agent stores this state insecurely or reuses it across tasks, a leaked file could enable account takeover or unauthorized access to web applications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The documented state save and state load commands enable persistent reuse of authenticated browser sessions, which can preserve cookies, local storage, and other auth context across runs. Without safeguards, this makes credential material portable and replayable, allowing unauthorized session reuse if the state file is exposed or mixed between tasks.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The example workflow encourages loading previously saved authenticated state in later sessions, normalizing persistent session reuse without discussing the security boundary implications. In multi-user or agentic environments, this can lead to cross-task privilege leakage, stale but valid authentication reuse, or account compromise if the saved state is copied.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · openclaw skills/SKILL.md (reported line 41)May include surrounding context.

agent-browser open # Navigate to page agent-browser snapshot -i # Get interactive elements with refs agent-browser click @e1 # Click element by ref agent-browser fill @e2 "text" # Fill input by ref agent-browser close # Close browser

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents screenshots, video recording, console/error capture, storage inspection, cookie access, and network request inspection without warning that these outputs may capture credentials, tokens, personal data, internal URLs, or proprietary content. In an agent context, these features can silently collect and persist sensitive data from arbitrary pages, increasing exfiltration and privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly instructs users to save and later reload authenticated browser state, but it does not warn that the resulting file can contain live session cookies, bearer tokens, or other authentication artifacts. If that file is stored insecurely, shared, checked into source control, or reused across environments, it can enable account/session hijacking.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The documented state save/load feature creates reusable persisted browser sessions, which can preserve authenticated access across runs. Without guardrails or warnings, this encourages storage and reuse of sensitive session artifacts that could be copied or abused to impersonate a user.

Content

Scanner excerpt · openclaw skills/SKILL.md (reported line 236)May include surrounding context.

bash
agent-browser state save auth.json    # Save session state
agent-browser state load auth.json    # Load saved state

Example: Form submission

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The example normalizes a workflow where a saved authenticated state is loaded to access a dashboard later, but it omits any caution about the security implications of replayable authentication state. That makes accidental token leakage, unauthorized reuse, and privilege carryover more likely in real deployments.

Content

Scanner excerpt · openclaw skills/SKILL.md (reported line 265)May include surrounding context.

agent-browser wait --url "/dashboard" agent-browser state save auth.json

Later sessions: load saved state

agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

text

Static analysis

No suspicious patterns detected.