Openclaw Browser Automation 1.0.1

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:40 AM UTC
• Version: 1.0.0

Overview

This browser automation skill is plausible for its purpose, but it exposes sensitive browsing state and external browser use with weak user control.

Install only if you are comfortable with an agent controlling a browser that may preserve cookies/passwords, save screenshots and downloads locally, access internal sites, and switch to Browserbase automatically when keys exist. Use isolated profiles, avoid sensitive accounts unless explicitly needed, clear stored browser data after use, and review any downloads before opening them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: REFERENCE.md:314

Finding

Persistent Authenticated Browser Profile Exposed Through a Fixed Chrome Debugging Interface

Content

View full analysis

Vulnerability Details

File Location: REFERENCE.md:314-382
Vulnerability Type: Persistent sensitive browser state combined with an exposed debugging interface and unrestricted downloads
Risk Level: Medium

Vulnerable Configuration

REFERENCE.md:314-318 documents that browser profiles are deliberately preserved:

text

**Implementation Details**:
- Calls `stagehand.close()` to clean up Playwright resources
- Kills Chrome process if it was started by the CLI tool
- Clears internal state variables
- Does NOT delete `.chrome-profile/` directory (preserved for reuse)

REFERENCE.md:354-368 documents the persistent profile and fixed Chrome DevTools Protocol port:

bash

--remote-debugging-port=9222
--user-data-dir=.chrome-profile
--window-position=-9999,-9999
--window-size=1280,720

text

**Arguments**:
- `--remote-debugging-port`: Enables CDP on port 9222
- `--user-data-dir`: Persistent profile directory for session/cookie persistence
- `--window-position`: Launches minimized off-screen
- `--window-size`: Default window size

REFERENCE.md:371-382 documents unrestricted automatic downloads:

typescript

await client.send("Browser.setDownloadBehavior", {
  behavior: "allow",
  downloadPath: "./agent/downloads",
  eventsEnabled: true,
})

text

**Behavior**:
- Downloads start automatically (no dialog)
- Files saved to `./agent/downloads/`
- Download events can be monitored via CDP

Technical Analysis

The browser is configured to retain .chrome-profile/, including session cookies and potentially other authenticated browser state, between automation runs. At the same time, Chrome is launched with its debugging protocol enabled on the predictable port 9222.

Chrome DevTools Protocol provides extensive control over an active browser, including page navigation, DOM inspection, script execution in page contexts, cookie access su ...[truncated 2399 chars]

Remediation

View remediation

Remediation Suggestions

1. Use isolated, ephemeral profiles

   • Create a unique browser profile directory for each task.
   • Delete the profile securely when the task ends.
   • Require explicit user consent before enabling cross-run session persistence.

2. Harden the debugging interface

   • Bind CDP explicitly to the loopback interface.
   • Select a random available port instead of fixed port 9222.
   • Do not expose the endpoint to containers, shared hosts, or network interfaces that do not require access.
   • Validate that the endpoint belongs to the Chrome process launched by the Skill before connecting.
   • Terminate the debugging endpoint immediately when automation completes.

3. Separate sensitive workflows

   • Use dedicated profiles for each user, origin, and security context.
   • Do not reuse a profile containing personal browsing data or unrelated authenticated sessions.
   • Avoid storing passwords in the automation profile.

4. Restrict network access

   • Block loopback, link-local, private-network, and cloud metadata destinations by default.
   • Allow internal destinations only after explicit user approval.
   • Enforce URL scheme and destination validation before navigation.

5. Control downloads

   • Require confirmation before initiating downloads.
   • Apply file-type and maximum-size restrictions.
   • Save files in a per-task quarantine directory.
   • Scan downloaded content before it is opened or moved elsewhere.

6. Improve auditability

   • Include the referenced src/cli.ts, package.json, and lockfile in the artifact.
   • Add tests verifying CDP binding, profile deletion, destination filtering, and download controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill states it will automatically switch to a remote Browserbase environment when API keys are present and explicitly says this occurs with no user prompting. Without a prominent warning that browsing content, session data, and possibly sensitive form inputs may be transmitted to external infrastructure, users may unknowingly expose private or regulated data.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

### First: Environment Selection (Local vs Remote)

The skill automatically selects between local and remote browser environments:
- **If Browserbase API keys exist** (BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in .env file): Uses remote Browserbase environment
- **If no Browserbase API keys**: Falls back to local Chrome browser
- **No user prompting**: The selection happens automatically based on available configuration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.json (reported line 17)May include surrounding context.

json

### First: Environment Selection (Local vs Remote)

The skill automatically selects between local and remote browser environments:
- **If Browserbase API keys exist** (BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in .env file): Uses remote Browserbase environment
- **If no Browserbase API keys**: Falls back to local Chrome browser
- **No user prompting**: The selection happens automatically based on available configuration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup.json (reported line 29)May include surrounding context.

json

### First: Environment Selection (Local vs Remote)

The skill automatically selects between local and remote browser environments:
- **If Browserbase API keys exist** (BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in .env file): Uses remote Browserbase environment
- **If no Browserbase API keys**: Falls back to local Chrome browser
- **No user prompting**: The selection happens automatically based on available configuration

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example explicitly demonstrates logging into a site with a username and password and notes reuse of Chrome's user profile, which may preserve session cookies between runs. In a browser-automation skill, this normalizes handling live credentials and persistent authenticated state without warning about secret handling, session leakage, or cross-task reuse, increasing the chance of exposing accounts or carrying privileged sessions into unrelated automations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation describes automatic screenshot capture after navigation and actions, with images stored on disk in a persistent directory, but does not present this as an explicit privacy or data-handling warning to the user. In a browser automation context, screenshots may capture sensitive page content, credentials, internal dashboards, or personal data, creating unintended local retention and possible later exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The reference explicitly states that downloads start automatically and are written to ./agent/downloads with no file type restrictions. In a browser automation skill, this can cause unanticipated disk writes, persistence of untrusted content, and potential follow-on risk if other tools later open or process downloaded files, especially because the browser can access arbitrary internet and internal resources.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description is broadly scoped to common browsing tasks such as navigating websites, extracting data, and interacting with web applications, which makes it likely to auto-trigger in many routine situations. That increases the chance the agent invokes a powerful browser automation capability without sufficiently narrow user intent or review, raising the risk of unintended web actions or data access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The download example states that files are automatically written to a local directory but does not warn that browsing to attacker-controlled or mistaken URLs can cause unreviewed local file writes. In the context of a browser automation tool, this can lead to unwanted file accumulation, storage of unsafe content, or downstream processing of untrusted files without user awareness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.