ClawHub

Bits Browser Automation

Security checks across malware telemetry and agentic risk

Overview

This browser automation skill is disclosed and purpose-aligned, but users should be careful because it can act on websites and uses an unpinned npm-based MCP install with an API key.

Install only if you trust the Bits service and the npm package it runs. Treat it as capable of acting on your behalf in a browser: confirm domains before use, avoid privileged accounts when possible, be cautious with OAuth/2FA and stored credentials, and consider pinning or reviewing the npm package before running it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly enables browser automation on third-party sites, including form submission and data extraction, but the description does not warn users that actions may affect external accounts, submit real data, or trigger irreversible changes. In a browser automation skill, missing consent and safety warnings increases the chance of accidental misuse against live websites and user accounts.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation advertises handling OAuth, login forms, 2FA, and stored credentials without any privacy, consent, or account-safety warning. That creates a meaningful risk of credential misuse, unauthorized account actions, and exposure of sensitive authentication material during automated sessions.

Session Persistence

Medium
Category
Rogue Agent
Content
1. Go to [app.usebits.com](https://app.usebits.com)
2. Sign in with Google
3. Navigate to **Settings → API Keys**
4. Click **Create API Key**, give it a name
5. Copy the key (starts with `bb_`) — you won't see it again

### 2. Configure MCP
Confidence
84% confidence
Finding
Create API Key**, give it a name 5. Copy the key (starts with `bb_`) — you won't see it again ### 2. Configure MCP Add to your MCP config (e.g., `~/.openclaw/openclaw.json`): ```json { "mcpServer

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal