ClawHub
Back to skill

Security audit

Midscene Automations Skills for Browser

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill is coherent, but it needs review because it can control a logged-in Chrome session and runs mutable npm packages automatically.

Install only if you are comfortable with an agent running the Midscene npm CLI and automating browser pages. Prefer isolated headless mode or a dedicated Chrome profile, avoid unrelated logged-in tabs, explicitly approve any CDP or Bridge use, and consider pinning reviewed package versions instead of using mutable npm tags.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:34
Finding

Unverified Third-Party Package Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34 and 126–248; unsafe upgrade guidance also appears at line 305
Vulnerability Type: Supply-chain exposure through mutable npm package references and automatic execution
Risk Level: Medium

Vulnerable Code

markdown
Automate web browsing using `npx -y @midscene/web@1`.

Representative executable commands include:

bash
npx -y @midscene/web@1 connect --url https://example.com
npx -y @midscene/web@1 act --prompt "click the Login button and fill in the email field with 'user@example.com'"
npx -y @midscene/web@1 assert --prompt "there is a login button visible"
npx -y @midscene/web@1 take_screenshot
npx -y @midscene/web@1 report-tool --action to-markdown --htmlPath ./midscene_run/report/.../index.html --outputDir ./output-markdown

The troubleshooting section also recommends a mutable version:

bash
npm i @midscene/web@latest @midscene/core@latest @midscene/shared@latest

Technical Analysis

The skill instructs the Agent to use npx -y, which can retrieve an npm package and execute its binary automatically without interactive confirmation. The package reference @midscene/web@1 pins only the major version, not an exact audited release. Consequently, later releases within the accepted version range may be executed without any corresponding review of their contents.

The @latest upgrade instruction is even less deterministic because the registry can resolve it to any release currently carrying that distribution tag. The project contains no lockfile, integrity metadata, checksum validation, vendored dependency, or installation procedure that separates package review from runtime execution.

This creates a supply-chain trust boundary: the code that ultimately executes is determined partly by mutable external npm registry state rather than solely by the audited project. The audit found no evidence that the currently named Midscene packages are malicious; the vulnerab ...[truncated 1847 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every dependency to an exact reviewed version rather than a major range or latest, for example:

    bash
    npm install --save-exact @midscene/web=X.Y.Z

  2. Commit a package manifest and lockfile containing registry integrity hashes. Perform installation in a controlled setup phase rather than downloading packages during each skill invocation.

  3. Invoke only the previously installed local binary and prohibit network installation at runtime, for example:

    bash
    npx --no-install midscene-web connect --url https://example.com

    Use the actual local binary name documented by the pinned package.

  4. Remove the recommendation to install @latest. Replace it with a documented update process that reviews release notes and package contents, updates to an exact version, regenerates the lockfile, and runs security tests before deployment.

  5. In hardened environments, install dependencies from an approved internal registry or artifact repository and verify package provenance, signatures where available, and lockfile integrity.

  6. Run browser automation in a least-privilege sandbox with restricted filesystem and network access. Provide only the environment variables needed for the current task.

  7. Treat CDP and Bridge sessions as sensitive capabilities. Require explicit user authorization before attaching to an existing browser, isolate automation profiles where possible, and avoid exposing unrelated authenticated tabs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill supports CDP and Bridge modes that attach to the user's real Chrome session with existing login state preserved, but the top-level description does not clearly foreground that this grants access to authenticated tabs, account pages, and sensitive browser data. That omission can mislead downstream agents or users into invoking the skill in a higher-trust context without realizing it can operate inside a logged-in session.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.