Security audit

Ai Pa Browser Clawdbot

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent browser-automation helper, but it under-discloses sensitive session, credential, recording, and global-install risks users should review before installing.

Review this skill before installing. Use only test or least-privilege accounts where possible, treat saved browser state files as secrets, keep them out of repositories and shared artifacts, avoid recording sensitive sessions, avoid putting real passwords directly in command lines, and prefer a pinned local install over a global latest npm install.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:54
Finding: Unpinned Global npm Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:46
Finding: Authenticated Browser State Saved to Predictable Unprotected Files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly documents saving and loading browser state files but does not warn that these files can contain cookies, session tokens, and other authentication artifacts. In an AI-agent workflow, users may persist or share auth.json across runs, which increases the chance of credential leakage, session hijacking, or accidental inclusion in logs, artifacts, or source control.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation advertises saving and loading browser state to disk via auth.json without warning that this state can contain authentication cookies, session tokens, and other sensitive data. In an AI-agent/browser-automation context, users may persist privileged sessions and later expose them through insecure file permissions, accidental commits, artifact uploads, or reuse across tasks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The recording commands are documented without noting that video capture can record credentials, personal data, session-specific content, and other sensitive UI elements visible during automation. Because this skill is designed for AI agents driving browsers, recordings may be generated unattended and stored or shared as artifacts, increasing the chance of unintended data disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Documenting agent-browser set credentials user pass without any warning encourages passing secrets directly on the command line, where they may be exposed in shell history, process listings, logs, CI output, or telemetry. In agent-driven environments this is especially risky because commands are often generated, logged, and replayed automatically, multiplying opportunities for credential leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The examples encourage saving and reusing authenticated browser state in a file without any warning that the file may contain session cookies or tokens equivalent to account access. In an AI-agent/browser automation context, users may casually persist or share these files, which can lead to session theft and unauthorized access if the file is exposed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The multi-session example loads separate admin and user authentication state files but provides no caution about the elevated sensitivity of privileged admin sessions. This is more dangerous in this skill's context because it normalizes handling reusable privileged session artifacts in automation workflows, increasing the chance of privilege misuse, leakage, or accidental cross-session confusion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The recording example shows creating a demo video after loading authenticated state, but it does not warn that recordings may capture secrets, PII, account data, or internal application content visible on screen. In a headless browser automation tool aimed at AI agents, this omission can lead to sensitive recordings being stored or shared without appropriate review.
Content: No source excerpt is available for this finding.