ClawHub
Back to skill

Security audit

Chromium

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent browser automation, but it runs a persistent authenticated headless browser with cookie import and disables Chromium's sandbox without adequate warnings.

Review this before installing. Use it only in a dedicated, unprivileged environment, avoid importing high-value account cookies, delete imported cookie files and profiles when done, do not add the optional cron job unless you need always-on browsing, and treat the disabled Chromium sandbox as a serious exposure for untrusted websites.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/start_chromium.sh:48
Finding

Chromium Security Sandbox Is Unconditionally Disabled

Content
View full analysis
"$LOG_FILE" 2>&1 & ``` ### Technical Analysis The launch script unconditionally supplies both `--no-sandbox` and `--disable-setuid-sandbox`. These options disable major Chromium process-isolation boundaries intended to contain compromised renderer processes. Browser automation necessarily processes untrusted and potentially attacker-controlled web content. Disabling the sandbox is not required for the Skill's declared browser-automation functionality on normally configured hosts. It therefore weakens the browser below the minimum security posture appropriate for the task. This setting does not itself exploit the host. Exploitation requires a separate Chromium vulnerability, such as a renderer memory-corruption flaw. If such a flaw is triggered, however, the absence of Chromium's sandbox can substantially reduce the barriers between compromised web content and resources accessible to the browser's operating-system account. ### Attack Path 1. The Skill starts Chromium with both sandbox mechanisms disabled. 2. The agent navigates to a malicious or compromised website. 3. The website suppli ...[truncated 1130 chars]
Remediation
View remediation

T06 · System Persistence

Warning
Location
README.md:109
Finding

Documentation Recommends Persistent Boot-Time Execution from a Mutable Workspace

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (14)

Tainted flow: 'req' from os.environ.get (line 42, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/import_cookies.py (reported line 52)May include surrounding context.

python
method="POST",
    )
    try:
        with urllib.request.urlopen(req, timeout=5) as resp:
            result = json.loads(resp.read())
            return result.get("ok", False)
    except Exception as e:

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt update && sudo apt install -y chromium-browser

Ubuntu (snap, often pre-installed):

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 128)May include surrounding context.

md
| `Address already in use` | Another Chromium is running. Run `pkill -f "chromium.*remote-debugging"` and try again |
| CDP doesn't respond | Check the log file for errors. Common cause: missing dependencies (`libnss3`, `libatk-bridge2.0-0`) |
| `No Chromium/Chrome binary found` | Install Chromium or set `CHROMIUM_BIN` to the correct path |
| Stale `SingletonLock` | The script handles this automatically. If it persists: `rm ~/.openclaw/workspace/chromium-profile/SingletonLock` |
| Cookie import fails | Make sure the OpenClaw gateway is running (`openclaw gateway run`) |

### Missing system libraries (headless Linux)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

A description-behavior mismatch is security-relevant because users and orchestrators may invoke the skill expecting ordinary browser automation while the underlying implementation reportedly reads local configuration/auth material from ~/.openclaw/openclaw.json and talks to a local browser-control API that is not disclosed. Hidden access to local secrets or privileged control channels increases the chance of unintended credential use, confused-deputy behavior, and unsafe trust decisions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/start_chromium.sh (reported line 32)May include surrounding context.

sh
# Remove stale SingletonLock if Chromium is not running
if ! pgrep -f "${BROWSER}.*--user-data-dir=.*${PROFILE_DIR##*/}" >/dev/null 2>&1; then
  rm -f "$PROFILE_DIR/SingletonLock"
fi

nohup "$BROWSER" \

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt update && sudo apt install -y chromium-browser

Ubuntu (snap, often pre-installed):

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt update && sudo apt install -y chromium-browser

Ubuntu (snap, often pre-installed):

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 135)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt update && sudo apt install -y chromium-browser

Ubuntu (snap, often pre-installed):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to export and copy authenticated browser cookies to another system for reuse in headless Chromium, but it does not clearly warn that these cookies are equivalent to active login sessions and can grant account access if intercepted, mishandled, or left on disk. In the context of a persistent browser automation skill, this increases the chance of session theft or unintended privilege reuse across environments.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The README recommends auto-starting a persistent headless Chromium instance with remote debugging on boot. Persistence combined with a standing browser automation service increases attack surface and can leave an always-available CDP endpoint and logged-in session environment running longer than necessary, especially if host hardening is weak.

Content

Scanner excerpt · README.md (reported line 113)May include surrounding context.

To launch Chromium automatically when the system starts, add a cron entry:

bash
crontab -e

Add:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill advertises and instructs use of capabilities that touch local environment state and network-accessible browser control, but it does not declare an explicit tool scope such as allowed tools or permissions. That weakens policy enforcement and makes it easier for a broadly-triggered skill to access sensitive local/browser resources without clear operator review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger text is broad enough to match many routine browsing requests, increasing the likelihood this skill is auto-selected in situations involving sensitive accounts, internal sites, or user-provided URLs. In this context, broad routing is more dangerous because the skill uses a persistent browser profile and supports authenticated session import, so accidental invocation can expose or reuse stored sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The cookie import instructions enable transfer of authenticated session cookies into a persistent profile without prominently warning that this can grant long-lived access to the user's account within the automation environment. Because the profile persists across restarts, imported cookies may remain available for later tasks or misuse, amplifying account takeover and data exposure risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The script deliberately launches Chromium under nohup with a persistent user-data directory, creating a long-lived browser session whose cookies, local storage, and authenticated state survive beyond the invoking task. In the context of a browser automation skill with cookie import and CDP enabled, this increases exposure of sensitive session data to later tasks or local attackers who can access the profile or debug port.

Content

Scanner excerpt · scripts/start_chromium.sh (reported line 35)May include surrounding context.

sh
rm -f "$PROFILE_DIR/SingletonLock"
fi

nohup "$BROWSER" \
  --remote-debugging-port="$DEBUG_PORT" \
  --user-data-dir="$PROFILE_DIR" \
  --no-first-run \