ClawHub
Back to skill

Security audit

line-oa-vnc-auth

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for temporary LINE OA remote login, but it handles a live business account through a public tunnel while disabling Chromium sandboxing and leaving session-profile cleanup somewhat under-specified.

Review before installing. Use this only for authorized LINE OA work, preferably inside a disposable VM/container or dedicated unprivileged user account. Avoid running Chromium with --no-sandbox if the host supports sandboxing, keep the Cloudflare tunnel open only while the user is actively logging in, and delete the isolated browser profile unless the user explicitly wants the session retained.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:51
Finding

Chromium Sandbox Disabled During Authentication Session

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51–52
Vulnerability Type: Insecure browser configuration
Risk Level: Medium

Vulnerable Code

bash
DISPLAY=:99 chromium --no-sandbox --disable-dev-shm-usage \
  --user-data-dir="$BASE/profile" --window-size=1280,900 "$CHAT_URL" &

Technical Analysis

The documented launch command uses Chromium's --no-sandbox option, disabling a principal security boundary that isolates renderer processes from the operating system. A dedicated browser profile separates browser state and cookies, but it does not replace process sandboxing or isolate Chromium from files and resources available to the operating-system user.

Because this browser processes remote LINE pages and their dependencies during an authentication session, a browser or renderer vulnerability could have greater impact than it would under a correctly configured Chromium sandbox. The risk also extends to malicious content loaded through redirects, compromised third-party resources, or content displayed in the messaging interface.

Attack Path

  1. The agent launches Chromium with --no-sandbox as documented.
  2. Chromium loads the configured LINE OA page and associated remote resources.
  3. A malicious or compromised resource exploits a Chromium renderer vulnerability.
  4. With Chromium's sandbox disabled, the exploit encounters fewer isolation boundaries.
  5. Successful exploitation executes with the privileges of the operating-system account running Chromium.
  6. The attacker may access files and processes available to that account, including temporary authentication-session artifacts.

Exploitation still requires a suitable browser vulnerability or equivalent malicious-content execution primitive; disabling the sandbox does not independently provide code execution.

Impact Assessment

Successful exploitation could obtain the privileges of the operating-system user running Chromium ...[truncated 433 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove --no-sandbox and run Chromium with its standard sandbox enabled.
  2. Ensure the host or container supports Chromium's sandbox requirements, including appropriate kernel features and namespace configuration.
  3. Run the browser as a dedicated, unprivileged operating-system user with no access to unrelated credentials, home-directory content, or agent state.
  4. If sandboxed Chromium cannot operate in the deployment environment, place the complete browser and remote-desktop stack inside a disposable VM or tightly restricted container.
  5. For containerized operation, drop unnecessary Linux capabilities, prohibit privileged mode, use a read-only root filesystem where practical, restrict mounted paths, and apply resource and network limits.
  6. Mount only the dedicated browser profile and temporary workspace, with restrictive permissions, and destroy the environment after teardown.
  7. Keep Chromium patched and obtained from an authenticated official distribution source.
  8. Add a startup check that fails closed when Chromium's sandbox cannot be initialized rather than automatically falling back to --no-sandbox.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 2)May include surrounding context.

text
# Authentication and browser state
.env
*.token
*.cookie
*.cookies

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

Linux（Debian/Ubuntu）範例：

bash
sudo apt-get update
sudo apt-get install -y chromium xvfb x11vnc novnc websockify cloudflared x11-apps xdotool openssl curl

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

Linux（Debian/Ubuntu）範例：

bash
sudo apt-get update
sudo apt-get install -y chromium xvfb x11vnc novnc websockify cloudflared x11-apps xdotool openssl curl

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Linux（Debian/Ubuntu）範例：

bash
sudo apt-get update
sudo apt-get install -y chromium xvfb x11vnc novnc websockify cloudflared x11-apps xdotool openssl curl

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Linux（Debian/Ubuntu）範例：

bash
sudo apt-get update
sudo apt-get install -y chromium xvfb x11vnc novnc websockify cloudflared x11-apps xdotool openssl curl

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

bash
sudo apt-get update
sudo apt-get install -y chromium xvfb x11vnc novnc websockify cloudflared x11-apps xdotool openssl curl

確認：

Static analysis

No suspicious patterns detected.