Brave Loggedin Tag Browsing

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:29 AM UTC
• Version: 2.0.1

Overview

The skill is openly designed to scrape X/Facebook through a logged-in Brave session, but it uses the user's broad browser profile, existing tabs, and weakened browser sandboxing in ways users should review carefully.

Install only if you are comfortable letting this skill use a logged-in browser session to read social-media pages. Prefer a dedicated Brave/Chrome profile containing only the X/Facebook accounts needed for this task, avoid running it against your normal browser profile, and do not run it on sensitive tabs or high-privilege accounts until sandboxing and profile isolation are fixed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:40
• Finding: Chromium Sandbox Protections Are Explicitly Disabled<![CDATA[ ## Vulnerability Details **File Location**: `index.js:40-46` **Vulnerability Type**: Browser execution without process sandboxing **Risk Level**: High Equivalent unsafe flags also appear in `index.ts:124-130` and `dist/index.js:78-84`. ### Vulnerable Code ```javascript const userDataDir = path.join(os.homedir(), '.config', 'google-chrome'); context = await chromium.launchPersistentContext(userDataDir, { headless: false, viewport: null, executablePath: '/usr/bin/brave-browser', args: ['--no-sandbox'] }); ``` The TypeScript implementation disables additional protections: ```typescript const userDataDir = `/home/shuttle/.config/google-chrome`; const context = await chromium.launchPersistentContext(userDataDir, { headless: false, viewport: null, executablePath: '/usr/bin/brave-browser', args: [ '--no-sandbox', '--disable-setuid-sandbox', '--disable-blink-features=AutomationControlled' ] }); ``` ### Technical Analysis The Skill launches Brave with `--no-sandbox`; the TypeScript and compiled implementations also use `--disable-setuid-sandbox`. These flags disable important Chromium containment boundaries intended to prevent compromised renderer processes from directly accessing the host environment. The browser renders remote content from X/Twitter and Facebook. Although these are expected destinations, profile content remains remotely controlled, and the browser must process complex HTML, JavaScript, images, video, fonts, and other resources. If any of that content exploits a browser-engine vulnerability, disabling the sandbox can turn a renderer compromise into host-level code execution under the account running the Skill. The risk is amplified because the browser is launched with a persistent authenticated profile rather than a disposable, minimally privileged profile. ### Attack Path 1. An attacker controls or compromises a social-media account that the user asks the Skill to inspect. 2. The Skill fails to ...[truncated 1366 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--no-sandbox` and `--disable-setuid-sandbox` from every implementation: - `index.js` - `index.ts` - `dist/index.js` 2. Fail closed if the browser cannot start with its normal sandbox protections instead of automatically weakening security. 3. Run browser automation under a dedicated, low-privilege operating-system account. 4. Use a container or similarly isolated runtime with a restrictive filesystem and network policy as defense in depth. 5. Use a dedicated browser profile containing only the minimum sessions required for this Skill. 6. Keep Brave/Chromium and Playwright patched to supported versions. 7. Regenerate `dist/index.js` from the corrected TypeScript source to prevent source/build divergence. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: index.js:40
• Finding: Automation Reuses the User's Full Default Authenticated Browser Profile<![CDATA[ ## Vulnerability Details **File Location**: `index.js:40-46` **Vulnerability Type**: Excessive access to browser credentials and unrelated authenticated sessions **Risk Level**: Medium Equivalent behavior appears in `index.ts:124-130` and `dist/index.js:78-84`. The TypeScript implementation additionally hard-codes `/home/shuttle/.config/google-chrome`. ### Vulnerable Code ```javascript const userDataDir = path.join(os.homedir(), '.config', 'google-chrome'); context = await chromium.launchPersistentContext(userDataDir, { headless: false, viewport: null, executablePath: '/usr/bin/brave-browser', args: ['--no-sandbox'] }); ``` The TypeScript implementation uses a fixed account path: ```typescript const userDataDir = `/home/shuttle/.config/google-chrome`; const context = await chromium.launchPersistentContext(userDataDir, { headless: false, viewport: null, executablePath: '/usr/bin/brave-browser', args: ['--no-sandbox', '--disable-setuid-sandbox', '--disable-blink-features=AutomationControlled'] }); ``` ### Technical Analysis The declared purpose requires authenticated access to X/Twitter and Facebook, but the implementation grants the automated browser access to the entire default Google Chrome profile. A general-purpose profile may contain: - Cookies and session tokens for unrelated websites. - Browsing history and cached content. - Autofill information and site permissions. - Installed extensions and extension data. - Other profile configuration and locally stored application data. This violates least privilege because the Skill only needs isolated sessions for the supported social-media platforms. The fixed `/home/shuttle` path is also unsafe and non-portable: on a shared system, execution under sufficient permissions could target another user's profile, while on other systems it will fail or behave unexpectedly. Launching Brave against a profile that may already be open can also cause lock conflicts or profile corrupti ...[truncated 1720 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a dedicated browser profile exclusively for this Skill. 2. Store only the minimum X/Twitter and Facebook sessions needed for the declared operation. 3. Make the profile path an explicit, validated configuration option rather than deriving the default browser profile automatically. 4. Reject the system's normal default profile path unless the user gives informed, explicit consent. 5. Remove the hard-coded `/home/shuttle` path from `index.ts` and the compiled output. 6. Verify directory ownership and permissions before opening a configured profile. 7. Prevent simultaneous use of the same profile and handle profile-lock errors safely. 8. Prefer a short-lived isolated browser context where authentication can be provisioned without exposing unrelated browser data. 9. Combine profile isolation with normal Chromium sandboxing and a low-privilege operating-system account. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: index.js:28
• Finding: CDP Mode Navigates the User's First Existing Browser Tab<![CDATA[ ## Vulnerability Details **File Location**: `index.js:28-34, 123-126` **Vulnerability Type**: Unsafe modification of shared browser state **Risk Level**: Low Equivalent behavior appears in `index.ts:111-117, 227-232`, `dist/index.js:65-71, 168-173`, and `test-facebook.js:26-31, 36-39`. ### Vulnerable Code ```javascript browser = await chromium.connectOverCDP(`http://localhost:${CDP_PORT}`); const ctxs = browser.contexts(); if (ctxs.length > 0) { context = ctxs[0]; const pages = context.pages(); page = pages[0] || await context.newPage(); connectionMode = 'opencdl'; console.log('✅ 連接到 OpenClaw Brave'); return; } ``` The selected existing page is later navigated without user confirmation: ```javascript const url = getUrl(platform, username); console.log(`🌐 ${url}`); try { await page.goto(url, { waitUntil: 'load', timeout: 15000 }); } catch (e) {} await page.waitForTimeout(platform === 'facebook' ? 4000 : 2000); ``` ### Technical Analysis After connecting through CDP, the implementation selects `pages[0]` whenever an existing page is available. It then calls `page.goto()` on that page. This silently replaces the contents of the user's first tab rather than creating a page dedicated to the Skill. In a shared authenticated browser session, the first tab may contain an unfinished form, unsaved text, an active administrative workflow, or sensitive application state. Navigating that tab can cause data loss and interfere with unrelated browser automation or user activity. The issue does not require control of the `username`; any normal invocation can trigger it. Attacker influence can make the disruption more targeted by inducing repeated Skill executions, but the underlying unsafe behavior is deterministic. ### Attack Path 1. The user or another Agent task has an existing browser tab with unsaved or active state. 2. OpenClaw exposes the browser through local CDP port 18800. 3. The Skill connects to the first available browser contex ...[truncated 901 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Always create a new page after connecting to an existing browser context: ```javascript context = ctxs[0]; page = await context.newPage(); ``` 2. Track whether the Skill created the page and close only that page in a `finally` block. 3. Never navigate or close pre-existing tabs owned by the user or other Agent tasks. 4. Consider creating a dedicated browser context where CDP and platform constraints permit it. 5. Add concurrency controls so simultaneous Skill invocations do not share a mutable page. 6. Apply the correction consistently to `index.js`, `index.ts`, `dist/index.js`, and `test-facebook.js`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (37)

Credential Access

High

• Category: Privilege Escalation

Content

**解決**：
1. 手動開啟 Brave，登入 X 或 Facebook 帳號
2. 保持瀏覽器開啟，重新執行技能
3. 或刪除 `~/.config/google-chrome/Default/Cookies` 重新登入

### 問題：提取不到帖子
**原因**：頁面載入不夠或選擇器變更

• Confidence: 97% confidence
• Finding: The README instructs users to manipulate the browser cookie store path directly (`~/.config/google-chrome/Default/Cookies`) while the skill's core purpose is to leverage authenticated browser state. Referencing the credential store in this context normalizes direct handling of sensitive session artifacts and can encourage unsafe practices around cookies, which are effectively authentication material for social-media accounts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The documented behavior claims broader cross-platform monitoring and data extraction than what the implementation reportedly provides. This mismatch is dangerous because users and reviewers may authorize access to logged-in sessions under false assumptions, reducing informed consent and hiding what the skill actually does or fails to do.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README highlights use of an already logged-in Brave session and even shows the returned logged-in account identity, but does not prominently warn that authenticated session context and account metadata may be accessed and surfaced. In a skill specifically designed to reuse live social-media sessions, under-warning the privacy implications materially increases the risk of unauthorized context disclosure.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The natural-language trigger examples are broad enough to overlap with ordinary user requests such as 'look at Trump's latest statements,' making unintended invocation of a privileged browsing skill more likely. Because this skill accesses a logged-in browser session and extracts account-contextual data, accidental triggering can expose private session context or cause silent collection of data the user did not explicitly authorize.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares no explicit tool scope or permission boundary even though it is designed to interact with a logged-in browser session and may access environment-backed capabilities. In the context of social-media browsing with authenticated sessions, missing scope declarations can allow broader-than-expected access and make review, enforcement, and user consent much weaker.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill description does not prominently warn that it accesses logged-in social-media sessions and may extract account-linked data. In this context, lack of disclosure is particularly risky because authenticated browser automation can expose private or sensitive information and may surprise users who did not intend to grant that level of access.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad enough to match ordinary browsing or social-media requests, which can cause the skill to activate unexpectedly. Because this skill targets logged-in sessions and extracts account-linked content, accidental invocation increases the risk of unintended authenticated access and data exposure.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Referencing 'npx playwright' without a pinned version introduces a supply-chain and reproducibility risk, because different versions may be resolved over time or a compromised upstream package could change behavior. For a skill that automates logged-in browsing, dependency drift can silently alter security properties or data-handling behavior.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This file presents its usage documentation and user-facing error text entirely in Chinese, with no indication that the user can choose another language. That creates a natural-language policy issue because the skill effectively enforces a specific language/locale for interaction without documented opt-in or justification.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code attaches to an existing local browser over CDP and immediately reuses the first available context and page. That grants the skill visibility and interaction capability over an already-authenticated browsing session, potentially exposing unrelated tabs, cookies, DOM content, and logged-in data far beyond the declared X/Facebook monitoring scope.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill launches Brave/Chromium with a persistent profile directory pointing to the user's existing Chrome profile, which exposes all saved cookies, history, and authenticated sessions available in that profile. This breaks least privilege because a task advertised as social-media browsing gains access to the user's broader browser identity and potentially every logged-in site.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The automation intentionally reads logged-in session state from a persistent browser profile but provides no explicit consent flow, warning, or disclosure to the user. In this context, the skill is specifically marketed as using a logged-in browser, so silent reuse of session data increases privacy and trust risks even if no credential material is directly exfiltrated in the code shown.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file’s natural-language comments are written entirely in Traditional Chinese and describe the skill behavior without offering any language choice or indicating that the locale is region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This code attaches to an existing Brave/Chrome session over CDP or launches a persistent browser context using the user's real profile directory, which exposes authenticated cookies, account state, and potentially unrelated browsing data to the skill. In the context of a social-media scraping skill explicitly designed to browse X/Twitter and Facebook while logged in, this creates a real privacy and account-abuse risk because the skill can access protected content and profile data without any explicit consent gating, profile isolation, or scope restrictions.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill attaches to an existing CDP-controlled browser or launches Brave with a persistent user profile directory, which gives it access to whatever authenticated sessions already exist in that profile. In this skill's context, that means it can read logged-in X/Facebook content and account state without establishing a scoped, isolated session, increasing the risk of unauthorized data access and session abuse if the skill is invoked unexpectedly or modified.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill launches a persistent logged-in browser profile and inspects login/account UI state to determine whether the user is signed in, but it provides no user-facing disclosure or consent gate. Even if used for benign monitoring, silently reading authenticated session state is privacy-sensitive and can surprise users because it reveals account presence and may enable further authenticated scraping.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill makes outbound requests to X/Twitter and Facebook and returns scraped profile/posts data, but there is no explicit disclosure that external sites will be contacted or that retrieved account data may come from an authenticated session. In a logged-in browsing skill, this creates privacy and compliance risk because the user may not realize the action uses their active account context.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The manifest explicitly describes using a logged-in Brave session to access X/Twitter and Facebook pages and extract content, but it does not disclose or constrain the privacy and account-data risks that come with operating inside an authenticated browser context. In a logged-in session, the skill may access personalized content, session-bound data, or perform actions under the user's identity if later implementation is overly broad, making the omission of warnings and scope restrictions a meaningful security concern.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script connects to an already logged-in Brave session over CDP, navigates to a Facebook profile, detects login state, and extracts page content without any explicit consent gate, warning, or scope restriction. In the context of a social-media browsing skill that is specifically designed to leverage authenticated sessions, this creates a real privacy and data-access risk because it can silently use a user's active account context to collect personalized or access-controlled information.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: 文件標題下的主要說明全文以繁體中文呈現，且未提供可選語言、雙語說明或任何語言/地區限制的理由。依規則，若技能對語言或地區有實質限制而未提供使用者選擇或合理說明，可能構成語言/locale 政策問題。

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The skill metadata and documentation are entirely presented in Chinese, with no indication that other languages are supported or that the user can choose their preferred language. This creates a language-policy concern because the skill appears to impose a specific locale without opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: Multiple user-visible strings, including console logs and error messages, are hard-coded in Traditional Chinese. The file does not provide locale selection, fallback behavior, or opt-in for this language choice, which is a natural-language policy concern under the locale rule.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The function navigates an automated browser to user-specified X/Twitter/Facebook URLs, which triggers network requests to third-party services and may expose system/browser metadata and authenticated session context. In this file there is no explicit disclosure to the user that external network access to these sites will occur.

Static analysis

No suspicious patterns detected.