ClawHub
Back to skill

Security audit

Chrome Extension Installer

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it includes a no-click Chrome extension install method that uses administrator privileges and persists through managed browser policy.

Review this carefully before installing. Prefer the Chrome Web Store method where the user can see and approve the extension. Do not use the force-install method unless you are intentionally administering the machine, have verified the exact extension ID, publisher, and permissions, and know how to remove the managed policy afterward.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:20
Finding

Privileged Silent Chrome Extension Installation Through Persistent Managed Policy

Content
View full analysis
" PLIST="/Library/Managed Preferences/com.google.Chrome.plist" sudo defaults write "$PLIST" ExtensionInstallForcelist -array-add "$EXTENSION_ID;https://clients2.google.com/service/update2/crx" ``` 2. Relaunch Chrome — extension installs automatically. ``` ### Technical Analysis The Skill instructs the agent to invoke `sudo` and modify the system-level Chrome managed-preferences file. Adding an extension to `ExtensionInstallForcelist` causes Chrome to install it without the ordinary “Add to Chrome” confirmation process and to enforce its continued presence. The procedure does not require: - Validation that the extension ID has Chrome's expected 32-character format. - Verification that the extension is owned by a trusted publisher. - Review of the extension's requested permissions. - An explicit, informed confirmation immediately before privileged modification. - An allowlist restricting which extensions may be force-installed. - Preservation and review of the existing managed policy. - A rollback process for removing only the newly added entry. Although the update endpoint is Google's official service, the selected extension is controlled by the supplied ID. Consequently, an attacker who influences that ID can direct the privileged policy change toward an unwanted Chrome Web Store extension. The policy mechanism bypasses the least-privilege, user-approved installation method already provided elsewhere in the Skill. ### Attack Path 1. An attacker persuades a user or agent to install an e ...[truncated 1510 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Instruction Override

High
Category
Prompt Injection
Confidence
70% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
## Finding extension IDs
- From Chrome Web Store URL: `https://chromewebstore.google.com/detail/NAME/**<ID_IS_HERE>**`
- From installed extension: chrome://extensions → enable Developer Mode → ID shown under each extension

## Known extensions on this Mac (Chrome Default profile)
- html.to.design

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents a silent force-install path that makes a privileged, persistent system policy change to Chrome without requiring the user's in-browser approval. In the context of browser extensions, this is dangerous because extensions can read page content, cookies, and browser activity, so silently installing one via managed preferences can create a durable surveillance or code-execution foothold in the user's browsing environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

This finding duplicates the same persistence mechanism by flagging the plist reference in the managed preferences path. The danger remains that the skill guides writing browser policy state that survives sessions and can enforce extension installation beyond what a normal user expects.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

  1. Write the extension ID to Chrome's managed preferences:
bash
EXTENSION_ID="<id>"
PLIST="/Library/Managed Preferences/com.google.Chrome.plist"
sudo defaults write "$PLIST" ExtensionInstallForcelist -array-add "$EXTENSION_ID;https://clients2.google.com/service/update2/crx"
  1. Relaunch Chrome — extension installs automatically.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

This finding duplicates the same persistence mechanism by flagging the plist reference in the managed preferences path. The danger remains that the skill guides writing browser policy state that survives sessions and can enforce extension installation beyond what a normal user expects.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

  1. Write the extension ID to Chrome's managed preferences:
bash
EXTENSION_ID="<id>"
PLIST="/Library/Managed Preferences/com.google.Chrome.plist"
sudo defaults write "$PLIST" ExtensionInstallForcelist -array-add "$EXTENSION_ID;https://clients2.google.com/service/update2/crx"
  1. Relaunch Chrome — extension installs automatically.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
97% confidence
Finding

This command uses sudo to write to /Library/Managed Preferences, which is a root-level system configuration area. Granting a skill the ability to perform privileged browser policy changes substantially raises risk because a malicious or mistaken extension ID could be installed with elevated trust and persistent effect across Chrome sessions and updates.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

bash
EXTENSION_ID="<id>"
PLIST="/Library/Managed Preferences/com.google.Chrome.plist"
sudo defaults write "$PLIST" ExtensionInstallForcelist -array-add "$EXTENSION_ID;https://clients2.google.com/service/update2/crx"
  1. Relaunch Chrome — extension installs automatically.

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

This is another match on the same privileged persistence path and is a true positive because it is part of the command that enforces ongoing extension installation through managed preferences. In skill context, persistent browser modification is more dangerous because the asset being modified is the user's primary browser profile, where extensions commonly receive broad access to browsing data.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

bash
EXTENSION_ID="<id>"
PLIST="/Library/Managed Preferences/com.google.Chrome.plist"
sudo defaults write "$PLIST" ExtensionInstallForcelist -array-add "$EXTENSION_ID;https://clients2.google.com/service/update2/crx"
  1. Relaunch Chrome — extension installs automatically.

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

This is another match on the same privileged persistence path and is a true positive because it is part of the command that enforces ongoing extension installation through managed preferences. In skill context, persistent browser modification is more dangerous because the asset being modified is the user's primary browser profile, where extensions commonly receive broad access to browsing data.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

bash
EXTENSION_ID="<id>"
PLIST="/Library/Managed Preferences/com.google.Chrome.plist"
sudo defaults write "$PLIST" ExtensionInstallForcelist -array-add "$EXTENSION_ID;https://clients2.google.com/service/update2/crx"
  1. Relaunch Chrome — extension installs automatically.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
## Notes
- Method 1 is always safe — opens the store page, user approves.
- Method 2 requires sudo and persists across Chrome updates.
- The OpenClaw sandbox browser (`profile=openclaw`) is separate from the user's Chrome profile — extensions installed here do NOT appear there.

Static analysis

No suspicious patterns detected.