Firm Browser Audit Pack

Browser automation security audit pack. Validates Playwright/Puppeteer headless configuration for dangerous arguments. 1 audit tool.

Security Scan

The skill is internally consistent — it describes a small browser-audit tool and is instruction-only — but it depends on an external extension (mcp-openclaw-extensions) whose provenance you should verify before use.

Purpose & Capability

The name/description claim to audit Playwright/Puppeteer headless arguments and the SKILL.md contains a single audit tool invocation consistent with that purpose. Minor note: the SKILL.md declares a dependency on mcp-openclaw-extensions >= 3.0.0, which is reasonable for providing the tool but is not otherwise described in the package metadata or manifest — verify that the extension is the expected provider of openclaw_browser_context_check.

Instruction Scope

Instructions are short and scoped: invoke openclaw_browser_context_check with a config_path. The SKILL.md does not instruct reading unrelated files, network exfiltration, or collecting credentials. It is minimal and focused on the declared audit task.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, which limits on-disk risk. The only install concern is the declared dependency on mcp-openclaw-extensions; how that extension is provided/installed is outside this skill and should be checked.

Credentials

The skill declares no required environment variables, credentials, or config paths. The audit operates on a user-provided config file path (config_path), which is proportional to the stated purpose.

Persistence & Privilege

The skill is not always-enabled and uses the platform default for model invocation. It does not request elevated persistence or claim to modify other skills or system-wide settings.

Assessment

This skill itself is a small instruction-only audit and appears to do what it claims, but it relies on the external package mcp-openclaw-extensions to provide the actual tool (openclaw_browser_context_check). Before installing or running: 1) Verify the source and integrity of mcp-openclaw-extensions (publisher, version, and release channel). 2) Inspect the extension or its code (if available) to confirm it only analyzes configs and does not transmit data externally. 3) When running audits, point config_path at non-sensitive sample configs first, and avoid feeding production secrets or credentials. 4) Because the skill's source/homepage is unknown, prefer running it in an isolated/test environment until you validate the extension it depends on.

⚠️ Contenu généré par IA — validation humaine requise avant utilisation.

Purpose

Audits browser automation configurations for security risks. Detects 13 dangerous Chrome/Chromium arguments (--no-sandbox, --disable-web-security, etc.) in Playwright and Puppeteer configs with severity-based classification.

Tools (1)

Tool	Description	Severity
openclaw_browser_context_check	Headless browser config security audit	CRITICAL (--no-sandbox), HIGH (others)

Usage

skills:
  - firm-browser-audit-pack

# Audit browser configuration:
openclaw_browser_context_check config_path=/path/to/config.json

Requirements

• mcp-openclaw-extensions >= 3.0.0