ClawHub
Back to skill

Security audit

browser Devtools Inspector

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate browser-debugging skill, but it needs review because it inspects arbitrary sites with an unsandboxed browser and can expose sensitive console and network data without safeguards.

Install only if you are comfortable running browser-inspection scripts yourself. Prefer local or staging targets, avoid raw production captures unless authorized, redact headers/tokens/cookies/PII before sharing output, and run the scripts in an isolated container or VM with Chromium sandboxing enabled where possible.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/capture_console.js:15
Finding

Chromium Sandbox Disabled for Untrusted Web Content

Content
View full analysis

Vulnerability Details

File Location: scripts/capture_console.js:15-18, scripts/capture_network.js:14-17, scripts/analyze_performance.js:14-17, scripts/check_cors.js:14-17
Vulnerability Type: Unsafe browser isolation configuration
Risk Level: High

Vulnerable Code

The following browser launch configuration appears in all four scripts:

js
browser = await puppeteer.launch({
  headless: true,
  args: ['--no-sandbox', '--disable-setuid-sandbox']
});

Technical Analysis

Both Chromium sandbox mechanisms are explicitly disabled. The scripts subsequently navigate to a URL supplied by the caller and process potentially hostile web content. Chromium's sandbox is a defense-in-depth boundary intended to isolate renderer processes from the host system. Disabling it substantially increases the consequences of a browser or renderer vulnerability.

This configuration is not inherently malicious, but it is an unsafe default for a tool whose intended function includes visiting arbitrary development and production websites. Headless mode does not provide an equivalent security boundary.

Attack Path

  1. An attacker convinces a user or Agent to inspect an attacker-controlled URL.
  2. One of the inspection scripts launches Chromium with --no-sandbox and --disable-setuid-sandbox.
  3. Chromium loads and executes the attacker's web content.
  4. The malicious page exploits a browser vulnerability.
  5. Because the normal Chromium sandbox is disabled, the exploit encounters fewer isolation boundaries when attempting to access the host environment.

Successful exploitation depends on the presence of a suitable Chromium vulnerability; the unsafe configuration does not by itself provide direct code execution.

Impact Assessment

A successful browser exploit could execute code with the operating-system privileges of the Node.js process. Depending on the execution environment, this may expose readable ...[truncated 198 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove --no-sandbox and --disable-setuid-sandbox and run Chromium with its supported sandbox enabled.
  • Run the scripts as a dedicated, unprivileged operating-system user.
  • If the hosting environment cannot support the Chromium sandbox, execute the browser inside a disposable container or virtual machine with:
    • A read-only root filesystem.
    • No sensitive host mounts.
    • No inherited secrets or cloud credentials.
    • Dropped Linux capabilities.
    • Resource limits.
    • Restricted outbound and internal-network access.
  • Keep Chromium and Puppeteer on reviewed, supported security releases.
  • Clearly warn and require confirmation if an operator attempts to inspect an untrusted external site.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/capture_console.js:96
Finding

Unrestricted Browser Navigation Enables Internal-Network Reconnaissance

Content
View full analysis

Vulnerability Details

File Location: scripts/capture_console.js:96-111, scripts/capture_network.js:109-128, scripts/analyze_performance.js:138-149, scripts/check_cors.js:138-149
Vulnerability Type: Unvalidated destination URL and server-side request forgery exposure
Risk Level: Medium

Vulnerable Code

scripts/capture_console.js accepts an arbitrary first argument and passes it to the browser workflow without validation:

js
// Parse arguments
const args = process.argv.slice(2);
const url = args[0];
const filter = args.find(a => a.startsWith('--filter='))?.split('=')[1] || 'all';
const verbose = args.includes('--verbose');

if (!url) {
  console.error('Usage: node capture_console.js <url> [--filter=error] [--verbose]');
  console.error('Filters: all, log, warn, error, info');
  process.exit(1);
}

captureConsole(url, filter, verbose);

scripts/capture_network.js follows the same pattern:

js
// Parse arguments
const args = process.argv.slice(2);
const url = args[0];
const filter = args.find(a => a.startsWith('--filter='))?.split('=')[1] || 'all';
const type = args.find(a => a.startsWith('--type='))?.split('=')[1] || 'all';
const pattern = args.find(a => a.startsWith('--pattern='))?.split('=')[1] || null;
const verbose = args.includes('--verbose');

if (!url) {
  console.error('Usage: node capture_network.js <url> [--filter=failed] [--type=xhr] [--pattern=/api/*]');
  console.error('Filters: all, failed, slow');
  console.error('Types: all, xhr, fetch, script, stylesheet, image, font, media, document');
  process.exit(1);
}

captureNetwork(url, filter, type, pattern, verbose);

scripts/analyze_performance.js and scripts/check_cors.js likewise accept and forward an unrestricted URL:

js
const args = process.argv.slice(2);
const url = args[0];
const verbose = args.includes('--verbose');

if (!url) {
  console.error('Usa
...[truncated 2622 chars]
Remediation
View remediation

Remediation Suggestions

  • Parse input with the standard URL class and permit only explicitly supported schemes, normally https: and, where required, http:.
  • Reject URLs containing embedded usernames or passwords.
  • Resolve destination hostnames before navigation and reject:
    • IPv4 and IPv6 loopback addresses.
    • RFC 1918 and unique-local private addresses.
    • Link-local addresses.
    • Multicast, unspecified, and reserved ranges.
    • Known cloud metadata destinations.
  • Revalidate the resolved address immediately before connection to reduce DNS-rebinding exposure.
  • Inspect and validate every redirect destination rather than validating only the initial URL.
  • Apply outbound firewall rules so the browser process cannot access internal or metadata networks.
  • Use an explicit hostname allowlist when the tool is deployed as an automated Agent capability.
  • Require informed operator confirmation before allowing private or local destinations for legitimate debugging.
  • Redact sensitive response headers, URLs, query strings, and console data before emitting reports.

T08 · Insecure Dependencies

Note
Location
scripts/package.json:4
Finding

Mutable Puppeteer Dependency Installed Without a Lockfile

Content
View full analysis

Vulnerability Details

File Location: scripts/package.json:4-9; installation guidance in SKILL.md:199-203 and SKILL.md:225-229
Vulnerability Type: Non-reproducible third-party dependency installation
Risk Level: Low

Vulnerable Code

json
{
  "name": "browser-devtools-inspector-scripts",
  "version": "1.0.0",
  "description": "Browser DevTools inspection scripts using Puppeteer",
  "scripts": {
    "install-deps": "npm install"
  },
  "dependencies": {
    "puppeteer": "^21.0.0"
  }
}

The documentation directs users to resolve dependencies dynamically:

bash
cd scripts
npm install

It also recommends:

bash
cd scripts
npm install puppeteer

No package lockfile is included in the audited project structure.

Technical Analysis

The caret constraint permits npm to select different compatible Puppeteer releases over time, while the absence of a lockfile also leaves transitive dependency versions mutable. As a result, two installations from the same source tree may execute different third-party code.

npm dependency installation may execute package lifecycle scripts. Puppeteer installation can also perform browser-related download and setup operations. A compromised registry account, malicious newly resolved transitive release, or dependency infrastructure compromise could therefore introduce code that was not present during review.

No evidence was found that the declared puppeteer package name is typosquatted or currently malicious. The finding concerns supply-chain hardening and reproducibility rather than a confirmed malicious dependency.

Attack Path

  1. A user follows SKILL.md and runs npm install.
  2. npm resolves the mutable Puppeteer range and transitive dependency graph using current registry metadata.
  3. A compromised or unexpectedly changed package is selected.
  4. Package lifecycle or runtime code executes with the privilege ...[truncated 593 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin Puppeteer to an exact, reviewed version rather than using a caret range.
  • Generate, review, and commit package-lock.json.
  • Replace documented npm install usage with npm ci for reproducible installations.
  • Review dependency lifecycle scripts and transitive dependencies before upgrades.
  • Use automated vulnerability and integrity scanning for the lockfile.
  • Perform dependency updates through a controlled review process.
  • Where operationally possible, install dependencies in an isolated build environment without production credentials or access to sensitive internal networks.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
node scripts/capture_console.js <url> [--filter=error]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
node scripts/capture_console.js <url> [--filter=error]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
node scripts/capture_console.js <url> [--filter=error]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
node scripts/capture_console.js <url> [--filter=error]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md
node scripts/capture_console.js <url> [--filter=error]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

md
node scripts/capture_console.js <url> [--filter=error]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

md
node scripts/capture_console.js <url> [--filter=error]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

md
node scripts/capture_console.js <url> [--filter=error]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.

md
node scripts/capture_console.js <url> [--filter=error]

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/common-issues.md (reported line 182)May include surrounding context.

md
**Possible Causes:**
1. Backend not running
2. Wrong API baseURL in .env
3. BOM encoding in PHP files
4. Redis connection failed
5. Database down

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly instructs users to capture browser console logs, network requests, headers, and endpoint data, which commonly contain sensitive material such as authorization headers, session identifiers, personal data, internal URLs, and error traces. Because the guidance lacks any warning, redaction requirement, or restriction on production use, it increases the likelihood that sensitive telemetry will be collected, stored, or shared insecurely during debugging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The production monitoring example normalizes collecting and exporting debugging data from a live production site to files without caution about privacy, credentials, or sensitive telemetry exposure. On real sites, captured errors and failed requests may include user-specific data, auth tokens, internal endpoints, and operational details, so encouraging export from production materially raises the risk of data leakage.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file documents itself as a page performance analyzer, which implies it should analyze the target page using the browser instance it just launched. However, after launching a browser at L13-L16, it calls puppeteer.newPage() at L18 rather than browser.newPage(), which diverges from that intended behavior and likely prevents the documented analysis flow from working as described.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This script captures all browser network responses for an arbitrary URL and emits full request URLs and response headers as JSON. Those artifacts can contain sensitive data such as query parameters, internal endpoints, session-related metadata, API keys in URLs, or authorization/cookie-related headers, so running it against real environments can unintentionally expose confidential information to logs, terminals, or downstream storage.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The header comment presents this script as a working CORS checker, but the actual code contradicts that intent by invoking newPage on the puppeteer module rather than on the launched browser instance. That causes the advertised check flow to fail before navigation and CORS analysis can occur, so the documented behavior is not what the code actually does.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This markdown file repeatedly tells users to run scripts like capture_network.js, capture_console.js, check_cors.js, and analyze_performance.js against target URLs, which likely collect or transmit browser/network data as part of debugging. The document provides no user-facing warning about possible privacy or data-handling impact of inspecting application traffic and console output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code navigates to a user-supplied URL and records response metadata for all loaded resources, including URLs, headers-derived sizes, and status codes, then prints them to output. Aside from a brief usage string and optional verbose message, there is no disclosure that running the script will initiate outbound network requests and surface detailed page/resource information.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified with a caret range ("^21.0.0"), which allows installation of newer minor and patch releases and makes builds non-reproducible. In a security-sensitive automation skill, this increases supply-chain risk because different environments may resolve to different code, including versions with newly introduced vulnerabilities or malicious compromise.

Content

Scanner excerpt · scripts/package.json (reported line 9)May include surrounding context.

json
"install-deps": "npm install"
  },
  "dependencies": {
    "puppeteer": "^21.0.0"
  },
  "engines": {
    "node": ">=14.0.0"

Unverifiable Dependency: puppeteer has 1 known advisory(ies) (CVE-2019-5786 (Use-After-Free in puppeteer)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.