ClawHub
Back to skill

Security audit

unbrowser

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed web-discovery helper with sensitive cookie and native-binary risks that are mostly scoped and explained.

Install only if you trust the pyunbrowser upstream package and are comfortable with a local browsing binary making requests from your machine. Treat any cookies given to it as login credentials, keep them host-scoped, approve account-changing actions explicitly, and prefer pinned or reviewed package versions in sensitive environments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:97
Finding

Unpinned Third-Party Native Binary Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
82% confidence
Finding

The skill explicitly supports importing and replaying browser-exported cookies via cookies_set, which enables authenticated session reuse without password or 2FA. Even though the document adds same-site and confirmation guardrails, this capability materially increases the risk of credential misuse, session hijacking, and unauthorized account access if an agent is compromised, mis-prompted, or given improperly sourced cookies.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md
- **Multipart uploads.** `submit` supports GET and `application/x-www-form-urlencoded` POST only; multipart upload forms require escalation.
- **Heavy JIT-bound JS** (Google Sheets, Figma, Notion editor). QuickJS is 20–50× slower than V8 — the page may technically run but settle times will be unworkable.
- **Login flows that require interactive auth.** Use the managed browser to log in once. Cookies exported from that session can be replayed via `cookies_set` **for the same site only** — see [Operational safety](#operational-safety) for the rules around cookie reuse.

## Escalation accountability

The default workflow is **unbrowser first**, not **unbrowser only**. If the user explicitly says `unbrowser only`, do not use the managed browser/CDP; return the `unbrowser` failure signal and ask before escalating.

- Escalate only after a concrete signal, such as: non-null `challenge`, `likely_js_filled` with no usable JSON store, a visual/browser-only requirement, interactive auth,

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.

md
- Prefer `query_text` / `query` when the page has stable visible labels or selector hints.
- Prefer `text_main` when the task is reading article/docs content.
- Prefer `extract`, `extract_cards`, `extract_list`, or `extract_table` when the page exposes structured data.
- Prefer `activate` for safe, reversible probes such as menus, tabs, and load-more controls; do not use it for authenticated state-changing actions without confirmation.
- If `chrome_escalation` is near the top, stop guessing and escalate instead of burning calls.

## RPC methods — advanced (use sparingly)

Scope Creep

Low
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.

md
| `blockmap.density.likely_js_filled === true` AND `json_scripts === 0` | Empty SSR shell, JS-rendered cells | Escalate. |
| `blockmap.structure` is empty or only `<body>` and the task needs structured content | DOM didn't settle, or the page is canvas/WebGL-only | Escalate. |
| `discover.escalations` contains route-level browser-only hints | The cheap path found a specific blocked URL/action | Escalate with that target instead of a vague page-level instruction. |
| `discover.routes` is empty with `same_origin: true` | No page-owned routes were found | Return that finding or broaden scope; don't invent routes. |
| `status >= 400` and no challenge detected | Genuine error | Don't escalate — the page is broken / rate-limited. Return the error. |

The `challenge` and `density` fields in `navigate`'s response are designed for exactly this routing decision — read them on every call.