ClawHub
Back to skill

Security audit

Agent Browser (projectamazonph)

Security checks for vulnerabilities and agentic risk

Overview

This package mixes an advertised self-improvement skill with an unrelated browser-automation SKILL.md and optional hooks that persistently steer future agent behavior.

Review carefully before installing. Install only if you want persistent self-improvement reminders and are comfortable with hooks influencing future sessions; avoid global hook setup, use scoped matchers, inspect scripts first, require explicit approval before writing SOUL.md/AGENTS.md/TOOLS.md, and treat any browser auth-state, cookie, or storage files as credentials.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
hooks/openclaw/handler.js:9
Finding

Lifecycle Hooks Inject Package-Controlled Instructions into Agent Context

Content
View full analysis
isInjectedReminderFile(file)); if (existingIndex === -1) { cleanedBootstrapFiles.push(reminderFile); } else { cleanedBootstrapFiles[existingIndex] = reminderFile; } event.context.bootstrapFiles = cleanedBootstrapFiles; ``` From `scripts/activator.sh:8-18`: ```bash # Output reminder as s ...[truncated 2572 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
hooks/openclaw/handler.js:14
Finding

Session-Derived Content Can Be Promoted into Persistent Agent Policy Files

Content
View full analysis
Remediation
View remediation

other

Warning
Location
SKILL.md:1
Finding

Primary Skill Manifest Does Not Match the Package's Declared and Executed Behavior

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
92% confidence
Finding

Directing users to place persistent hook configuration in ~/.claude/settings.json affects the agent's global config directory, creating cross-project persistence and trust expansion. If abused or carelessly adopted, this can cause unreviewed scripts to run automatically in unrelated contexts with access to broader prompt and workspace data.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 181)May include surrounding context.

sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly instructs users to save and load browser authentication state, which commonly contains cookies and other session artifacts that can grant account access if copied or reused. In a browser automation skill, this is contextually more dangerous because the feature is presented as a convenience to bypass login without any warning about secure storage, scope limitation, or secret-handling requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill documents direct access to cookies and local storage, which may expose session tokens, CSRF tokens, PII, or other sensitive application data. This is more dangerous in this skill's context because it is an operational guide for browser automation, making data extraction and replay straightforward while providing no caution about authorized use, redaction, or secure handling.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

The guide encourages adding persistent hook configuration to agent settings so behavior survives session restarts and continues automatically. Persistence is not inherently malicious, but in this context it increases risk by making execution durable and easy to forget, especially when tied to prompt-triggered commands.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Using an empty matcher causes the hook to fire on every prompt, creating broad, automatic execution with no scope restriction. In an agent environment, always-on hooks increase the blast radius of any buggy or unsafe script and can expose sensitive prompt content or context more often than necessary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This example combines an empty matcher with user-level configuration in ~/.claude/settings.json, enabling automatic execution across all sessions and projects. That makes any script behavior persistent and broadly applied, increasing risk of unintended data exposure, context capture, or abuse if the script is modified later.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The Codex example also uses an empty matcher, resulting in unconditional hook activation for every prompt. While presented as convenience, it normalizes broad automatic execution without guardrails, which is risky in tools that may process sensitive prompts or varied repositories.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document claims the scripts 'only output text' and 'don't modify files or run commands,' but the hook configuration explicitly executes shell scripts via a command hook. That mismatch can cause users to underestimate execution risk and grant broad trust to code that runs automatically on prompts or tool events.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The 'Detection Triggers' section lists generic conditions such as 'Knowledge gaps', 'API errors', and user corrections without defining boundaries for when the skill should activate or what should be excluded. Because these conditions are common in ordinary interactions, the trigger scope is not specific enough to prevent overbroad invocation behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.