ClawHub
Back to skill

Security audit

Server Browser Automation

Security checks across malware telemetry and agentic risk

Overview

This skill is a real browser-automation setup, but it gives agents persistent control over logged-in browser sessions with weak isolation and broad server access.

Install only on a dedicated, disposable, or tightly controlled automation host. Run VNC and Chrome as a non-root user, firewall or SSH-tunnel VNC and Chrome debugging ports, avoid high-value personal accounts, use separate browser profiles for each account, stop Chrome/VNC when finished, and require explicit human approval before posting, submitting forms, purchasing, deleting, or changing account data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
This is a real security issue, not just a misleading comment. The script configures Chrome with remote debugging enabled on port 18800 and launches it with --no-sandbox, which significantly weakens browser isolation and can expose a powerful control interface if reachable by local or remote attackers. In the context of a server automation skill, exposing a remotely controllable browser is especially dangerous because it may allow session theft, arbitrary browser actions, and easier host compromise paths.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README instructs users to launch Chrome with both --remote-debugging-port=18800 and --no-sandbox, but provides no warning that remote debugging can expose full browser control and that disabling the sandbox removes a major security boundary. In a server/VNC environment, this combination can materially increase the risk of browser takeover, session theft, and host compromise if the port is reachable or the browser processes untrusted content.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The skill includes broad natural-language trigger examples such as opening sites, logging in, scraping content, and extracting links without clear scoping, confirmation, or authorization boundaries. In an agent setting, vague triggers can cause unintended browser actions against authenticated sessions, especially because this skill is explicitly designed to preserve login state and let AI operate sites on the user's behalf.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The document promotes persistent browser profiles and cookie reuse for post-login automation but does not adequately warn that these artifacts may contain active sessions, personal data, or account tokens. On a shared or remotely accessible server, persistent authenticated state materially increases the risk of account takeover, privacy leakage, and unauthorized automated actions.

Chaining Abuse

High
Category
Tool Misuse
Content
vncserver :1 -geometry 1920x1080 -depth 24

# 3. 安装 Chrome
wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
sudo sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google-chrome.list'
sudo apt-get update
sudo apt-get install -y google-chrome-stable
Confidence
91% confidence
Finding
| sudo

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.