ClawHub
Back to skill

Security audit

Nstbrowser AI Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill’s browser automation purpose is coherent, but it ships unsafe shell templates and relies on mutable npm execution paths that need review before installation.

Install only if you are comfortable reviewing or avoiding the bundled shell templates. Prefer a pinned nstbrowser-ai-agent version, do not pass real API keys or proxy passwords in commands that may be logged, verify target profile IDs before delete/clear/batch operations, and do not run the eval-based templates with untrusted profile or proxy values until they are rewritten to use safe shell argument arrays.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
templates/batch-proxy-update.sh:198
Finding

Command Injection Through eval in Batch Proxy Update Template

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
templates/profile-setup.sh:164
Finding

Command Injection Through eval in Profile Setup Template

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:789
Finding

Unpinned npm Package Installation and Execution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (43)

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

The declared description presents a broad browser automation CLI focused on NST profile management, proxy setup, batch profile operations, pagination, and anti-detection features. The supplied code chunk does use Nstbrowser and profile-based browser automation, so it is related in domain. However, the actual code is only a workflow demo script for a single profile: it checks environment variables, confirms connectivity, lists profiles, verifies one profile exists, starts the browser, opens a page, saves a snapshot and screenshot, and stops the browser. It does not perform proxy configuration, batch updates, starting multiple browsers, pagination handling, or any explicit fingerprint/anti-detection configuration. Thus the description materially overstates the implemented capabilities and triggers compared with this code chunk.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · references/profile-management.md (reported line 93)May include surrounding context.

md
- Geo-targeting (appear from different locations)
- IP rotation (use different IPs per profile)
- Privacy (hide your real IP)
- Access control (bypass restrictions)

### Profile Lifecycle

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/profile-management.md (reported line 93)May include surrounding context.

md
- Geo-targeting (appear from different locations)
- IP rotation (use different IPs per profile)
- Privacy (hide your real IP)
- Access control (bypass restrictions)

### Profile Lifecycle

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/troubleshooting.md (reported line 474)May include surrounding context.

brew upgrade google-chrome

Linux

sudo apt-get update && sudo apt-get upgrade google-chrome-stable

text

3. Increase memory allocation:

Instruction Override

High
Category
Prompt Injection
Confidence
70% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 691)May include surrounding context.

Reviewing Logs

bash
# Enable debug mode
export NSTBROWSER_AI_AGENT_DEBUG=1

# Run command with debug output

Instruction Override

High
Category
Prompt Injection
Confidence
70% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 714)May include surrounding context.

Reviewing Logs

bash
# Enable debug mode
export NSTBROWSER_AI_AGENT_DEBUG=1

# Run command with debug output

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The manifest itself references npx nstbrowser-ai-agent without a version pin in allowed-tools. Because allowed-tools defines what the agent may execute, an unpinned package here directly exposes the runtime to arbitrary upstream changes or compromise.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description lists specific trigger phrases but then adds "or any task requiring Nstbrowser's anti-detection features," which is open-ended and lacks clear boundaries. This broad phrasing could cause unintended invocation for many browser-related requests without explicit constraints or negative examples.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The manifest allows execution via npx nstbrowser-ai-agent:* without pinning to a specific version. That permits fetching and running whatever version is current at execution time, creating a supply-chain risk where a compromised or malicious upstream release could execute arbitrary code in the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The documentation instructs use of npx nstbrowser-ai-agent --help without a version pin, which normalizes unpinned package execution. While presented as setup guidance, it still encourages runtime retrieval of mutable code from the registry.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
# 1. List available profiles
nstbrowser-ai-agent profile list

# 2. Create a new profile (if needed)
nstbrowser-ai-agent profile create my-profile

# 3. Open browser with profile (auto-starts if not running)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill documents permanent profile deletion commands without any warning, confirmation guidance, or recovery caveat. In an agent setting, destructive commands lacking explicit safeguards increase the chance of accidental data loss, including deletion of persistent sessions, cookies, and profile state.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 392)May include surrounding context.

nstbrowser-ai-agent click 'button[type="submit"]'

text

**Fill Input**
```bash
# Fill by ref
nstbrowser-ai-agent fill @e2 "text"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documented cache and cookie clearing commands are destructive to session state but lack warnings about logout, loss of stored state, or operational impact. In this context, profiles are explicitly used for persistence, so clearing these stores can silently break workflows and destroy valuable session data.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 729)May include surrounding context.

md
### Interaction Commands
- `click <sel>` - Click element
- `fill <sel> <text>` - Fill input
- `type <sel> <text>` - Type into element
- `press <key>` - Press key
- `wait <sel|ms>` - Wait for element or time

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The update instructions include unpinned npx usage, which can pull an unexpected package version at runtime. In a skill meant for agent automation, this increases supply-chain exposure because the agent may execute commands exactly as documented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The batch tag update/clear commands are documented without a clear warning that existing tags will be fully replaced or removed for every selected profile, which can cause large-scale metadata loss or misclassification. In this skill, tags appear to drive organization and operational selection, so accidental bulk overwrites can cascade into further incorrect automation against the wrong profiles.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This documentation includes batch cache/cookie clearing workflows and examples that can target all or group-selected profiles without an explicit warning that sessions, authentication state, and local browser data will be irreversibly removed. In an AI-agent/browser-profile management context, destructive bulk actions are especially risky because broad selectors and automation can amplify mistakes across many profiles at once.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file documents profile delete as a bulk-capable destructive operation, but it does not warn that profiles may be permanently removed or advise users to verify targets before execution. Under the markdown-file criteria, destructive behaviors that can affect user data should include an explicit warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The profile cookies clear command removes browser cookies for one or more profiles, which can sign users out and erase session state, but the markdown does not disclose this impact. This is a user-data-affecting behavior that should be explicitly warned about.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation shows proxy credentials passed directly as command-line arguments, which can leak via shell history, terminal logging, CI logs, and process listings visible to other local users. Because this skill is specifically for browser profile and proxy management, users are likely to copy these commands verbatim with real credentials, increasing the chance of secret exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The manual testing examples embed usernames and passwords in proxy URLs, which is a well-known secret-handling risk because the full command can be captured in shell history, monitoring tools, debugging logs, and process arguments. In this anti-detection/proxy-automation context, operators are especially likely to use sensitive paid proxy credentials, so accidental disclosure can lead to credential theft or proxy abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The troubleshooting guide tells users to print the API key with echo $NST_API_KEY and view the env file with cat .nstbrowser-ai-agent.env without any warning that these actions can expose secrets in terminals, screen recordings, shell history, or shared support logs. In a browser automation/proxy-management tool, API keys are highly sensitive because they can grant access to profile management and related infrastructure.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting.md (reported line 70)May include surrounding context.

  1. Check firewall settings:
bash
# macOS: Check if port is allowed
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --listapps

# Linux: Check iptables
sudo iptables -L -n | grep 8848

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting.md (reported line 73)May include surrounding context.

  1. Check firewall settings:
bash
# macOS: Check if port is allowed
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --listapps

# Linux: Check iptables
sudo iptables -L -n | grep 8848

Static analysis

No suspicious patterns detected.