T09 · Insecure Skill Coding Practices
Error
- Location
index.js:40- Finding
Chromium Sandbox Protections Are Explicitly Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
Brave Loggedin Tag Browsing
Security checks for vulnerabilities and agentic risk
Overview
The skill is openly designed to scrape X/Facebook through a logged-in Brave session, but it uses the user's broad browser profile, existing tabs, and weakened browser sandboxing in ways users should review carefully.
Install only if you are comfortable letting this skill use a logged-in browser session to read social-media pages. Prefer a dedicated Brave/Chrome profile containing only the X/Facebook accounts needed for this task, avoid running it against your normal browser profile, and do not run it on sensitive tabs or high-privilege accounts until sandboxing and profile isolation are fixed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
index.js:40- Finding
Automation Reuses the User's Full Default Authenticated Browser Profile
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
index.js:28- Finding
CDP Mode Navigates the User's First Existing Browser Tab
- Content
View full analysis
0) { context = ctxs[0]; const pages = context.pages(); page = pages[0] || await context.newPage(); connectionMode = 'opencdl'; console.log('✅ 連接到 OpenClaw Brave'); return; } ``` The selected existing page is later navigated without user confirmation: ```javascript const url = getUrl(platform, username); console.log(`🌐 ${url}`); try { await page.goto(url, { waitUntil: 'load', timeout: 15000 }); } catch (e) {} await page.waitForTimeout(platform === 'facebook' ? 4000 : 2000); ``` ### Technical Analysis After connecting through CDP, the implementation selects `pages[0]` whenever an existing page is available. It then calls `page.goto()` on that page. This silently replaces the contents of the user's first tab rather than creating a page dedicated to the Skill. In a shared authenticated browser session, the first tab may contain an unfinished form, unsaved text, an active administrative workflow, or sensitive application state. Navigating that tab can cause data loss and interfere with unrelated browser automation or user activity. The issue does not require control of the `username`; any normal invocation can trigger it. Attacker influence can make the disruption more targeted by inducing repeated Skill executions, but the underlying unsafe behavior is deterministic. ### Attack Path 1. The user or another Agent task has an existing browser tab with unsaved or active state. 2. OpenClaw exposes the browser through local CDP port 18800. 3. The Skill connects to the first available browser contex ...[truncated 901 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (37)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The README instructs users to manipulate the browser cookie store path directly (
~/.config/google-chrome/Default/Cookies) while the skill's core purpose is to leverage authenticated browser state. Referencing the credential store in this context normalizes direct handling of sensitive session artifacts and can encourage unsafe practices around cookies, which are effectively authentication material for social-media accounts.- Content
md **解決**： 1. 手動開啟 Brave，登入 X 或 Facebook 帳號 2. 保持瀏覽器開啟，重新執行技能 3. 或刪除 `~/.config/google-chrome/Default/Cookies` 重新登入 ### 問題：提取不到帖子 **原因**：頁面載入不夠或選擇器變更
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The documented behavior claims broader cross-platform monitoring and data extraction than what the implementation reportedly provides. This mismatch is dangerous because users and reviewers may authorize access to logged-in sessions under false assumptions, reducing informed consent and hiding what the skill actually does or fails to do.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README highlights use of an already logged-in Brave session and even shows the returned logged-in account identity, but does not prominently warn that authenticated session context and account metadata may be accessed and surfaced. In a skill specifically designed to reuse live social-media sessions, under-warning the privacy implications materially increases the risk of unauthorized context disclosure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The natural-language trigger examples are broad enough to overlap with ordinary user requests such as 'look at Trump's latest statements,' making unintended invocation of a privileged browsing skill more likely. Because this skill accesses a logged-in browser session and extracts account-contextual data, accidental triggering can expose private session context or cause silent collection of data the user did not explicitly authorize.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares no explicit tool scope or permission boundary even though it is designed to interact with a logged-in browser session and may access environment-backed capabilities. In the context of social-media browsing with authenticated sessions, missing scope declarations can allow broader-than-expected access and make review, enforcement, and user consent much weaker.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description does not prominently warn that it accesses logged-in social-media sessions and may extract account-linked data. In this context, lack of disclosure is particularly risky because authenticated browser automation can expose private or sensitive information and may surprise users who did not intend to grant that level of access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to match ordinary browsing or social-media requests, which can cause the skill to activate unexpectedly. Because this skill targets logged-in sessions and extracts account-linked content, accidental invocation increases the risk of unintended authenticated access and data exposure.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Referencing 'npx playwright' without a pinned version introduces a supply-chain and reproducibility risk, because different versions may be resolved over time or a compromised upstream package could change behavior. For a skill that automates logged-in browsing, dependency drift can silently alter security properties or data-handling behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This file presents its usage documentation and user-facing error text entirely in Chinese, with no indication that the user can choose another language. That creates a natural-language policy issue because the skill effectively enforces a specific language/locale for interaction without documented opt-in or justification.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code attaches to an existing local browser over CDP and immediately reuses the first available context and page. That grants the skill visibility and interaction capability over an already-authenticated browsing session, potentially exposing unrelated tabs, cookies, DOM content, and logged-in data far beyond the declared X/Facebook monitoring scope.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill launches Brave/Chromium with a persistent profile directory pointing to the user's existing Chrome profile, which exposes all saved cookies, history, and authenticated sessions available in that profile. This breaks least privilege because a task advertised as social-media browsing gains access to the user's broader browser identity and potentially every logged-in site.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The automation intentionally reads logged-in session state from a persistent browser profile but provides no explicit consent flow, warning, or disclosure to the user. In this context, the skill is specifically marketed as using a logged-in browser, so silent reuse of session data increases privacy and trust risks even if no credential material is directly exfiltrated in the code shown.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file’s natural-language comments are written entirely in Traditional Chinese and describe the skill behavior without offering any language choice or indicating that the locale is region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code attaches to an existing Brave/Chrome session over CDP or launches a persistent browser context using the user's real profile directory, which exposes authenticated cookies, account state, and potentially unrelated browsing data to the skill. In the context of a social-media scraping skill explicitly designed to browse X/Twitter and Facebook while logged in, this creates a real privacy and account-abuse risk because the skill can access protected content and profile data without any explicit consent gating, profile isolation, or scope restrictions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill attaches to an existing CDP-controlled browser or launches Brave with a persistent user profile directory, which gives it access to whatever authenticated sessions already exist in that profile. In this skill's context, that means it can read logged-in X/Facebook content and account state without establishing a scoped, isolated session, increasing the risk of unauthorized data access and session abuse if the skill is invoked unexpectedly or modified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill launches a persistent logged-in browser profile and inspects login/account UI state to determine whether the user is signed in, but it provides no user-facing disclosure or consent gate. Even if used for benign monitoring, silently reading authenticated session state is privacy-sensitive and can surprise users because it reveals account presence and may enable further authenticated scraping.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill makes outbound requests to X/Twitter and Facebook and returns scraped profile/posts data, but there is no explicit disclosure that external sites will be contacted or that retrieved account data may come from an authenticated session. In a logged-in browsing skill, this creates privacy and compliance risk because the user may not realize the action uses their active account context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest explicitly describes using a logged-in Brave session to access X/Twitter and Facebook pages and extract content, but it does not disclose or constrain the privacy and account-data risks that come with operating inside an authenticated browser context. In a logged-in session, the skill may access personalized content, session-bound data, or perform actions under the user's identity if later implementation is overly broad, making the omission of warnings and scope restrictions a meaningful security concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script connects to an already logged-in Brave session over CDP, navigates to a Facebook profile, detects login state, and extracts page content without any explicit consent gate, warning, or scope restriction. In the context of a social-media browsing skill that is specifically designed to leverage authenticated sessions, this creates a real privacy and data-access risk because it can silently use a user's active account context to collect personalized or access-controlled information.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
文件標題下的主要說明全文以繁體中文呈現，且未提供可選語言、雙語說明或任何語言/地區限制的理由。依規則，若技能對語言或地區有實質限制而未提供使用者選擇或合理說明，可能構成語言/locale 政策問題。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill metadata and documentation are entirely presented in Chinese, with no indication that other languages are supported or that the user can choose their preferred language. This creates a language-policy concern because the skill appears to impose a specific locale without opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Multiple user-visible strings, including console logs and error messages, are hard-coded in Traditional Chinese. The file does not provide locale selection, fallback behavior, or opt-in for this language choice, which is a natural-language policy concern under the locale rule.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The function navigates an automated browser to user-specified X/Twitter/Facebook URLs, which triggers network requests to third-party services and may expose system/browser metadata and authenticated session context. In this file there is no explicit disclosure to the user that external network access to these sites will occur.
- Content