Skills Browser

ReviewAudited by ClawScan on May 10, 2026.

Overview

This looks like a real local skills browser, but it exposes its web server too broadly and performs unsafe local process handling.

Install only if you are comfortable running a local web server and can review or modify the code. Prefer changing it to bind to 127.0.0.1, removing wildcard CORS, fixing the path validation, and replacing the force-kill startup behavior before use.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

While the server is running, other devices on the network or websites loaded in the user's browser may be able to query the installed skills list and skill details.

Why it was flagged

The API permits any web origin to read responses and the server listens on all network interfaces, despite the skill being described as a local browser accessed at 127.0.0.1.

Skill content

self.send_header("Access-Control-Allow-Origin", "*") ... server = HTTPServer(("0.0.0.0", port), Handler)

Recommendation

Bind only to 127.0.0.1, remove wildcard CORS unless strictly needed, and consider a local-only token or same-origin access model.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

A crafted request may be able to traverse outside the intended skills directory and read other reachable files named SKILL.md.

Why it was flagged

The URL path segment is used directly in a filesystem path without normalization or containment checks.

Skill content

skill_id = parsed.path[11:]
md_path = os.path.join(SKILL_DIR, skill_id, "SKILL.md")

Recommendation

Validate skill IDs against the enumerated skills list, reject path separators and '..', and verify the resolved path remains inside the intended skills directory.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

Running the skill could terminate an unrelated local service and potentially disrupt work or cause data loss in that service.

Why it was flagged

The launch script force-kills any process listening on port 8765, not just a prior instance of this skill.

Skill content

lsof -ti:8765 | xargs kill -9 2>/dev/null

Recommendation

Do not force-kill arbitrary port users. Detect whether the process belongs to this skill, ask for confirmation, use graceful shutdown, or choose another free port.

Low

#ASI10: Rogue Agents

What this means

The local web server may continue running after the user thinks they are done, keeping the exposed API available.

Why it was flagged

The script starts the server in the background while PID tracking and waiting are commented out, so the process is not clearly tied to the invoking session.

Skill content

python3 server.py &

# SERVER_PID=$!
...
# wait $SERVER_PID

Recommendation

Track the server PID, provide a clear stop command or browser shutdown endpoint, and document how users can terminate the server.