Server Browser Automation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:42 AM UTC
• Version: 1.0.0

Overview

The skill is a real browser-automation setup, but it provisions a high-risk server desktop/browser environment with root execution, persistent sessions, and exposed remote-control surfaces that need review before installation.

Review this skill before installing. Use only on an isolated development server or VM, avoid running the browser/VNC session as root, do not expose VNC or Chrome debugging ports to the network, protect or avoid persistent profiles containing real login cookies, and inspect the installer instead of relying on the npm install hook.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: install.sh:9

Finding

VNC and Unsandboxed Chrome Are Configured to Run as Root

Content

View full analysis

$VNC_HOME/.vnc/xstartup << 'EOF' #!/bin/bash unset SESSION_MANAGER unset DBUS_SESSION_BUS_ADDRESS exec startxfce4 EOF chmod +x $VNC_HOME/.vnc/xstartup chown -R $VNC_USER:$VNC_USER $VNC_HOME/.vnc # 5. 提示用户设置 VNC 密码 echo "" echo "🔐 请设置 VNC 密码：" su - $VNC_USER -c "vncpasswd" # 6. 启动 VNC echo "🚀 启动 VNC 服务器..." su - $VNC_USER -c "vncserver :1 -geometry 1920x1080 -depth 24" ``` ```bash cat > $VNC_HOME/start-chrome.sh << 'EOF' #!/bin/bash export DISPLAY=:1 google-chrome \ --remote-debugging-port=18800 \ --no-sandbox \ --disable-gpu \ --disable-dev-shm-usage \ --user-data-dir=/home/$(whoami)/.config/openclaw-browser-openclaw \ > /tmp/chromium.log 2>&1 & echo "✅ Chrome 已启动（端口 18800）" echo "📄 日志：/tmp/chromium.log" EOF ``` ### Technical Analysis The installer refuses to run unless its effective user is root. It then uses `whoami` to determine `VNC_USER`. Because the effective user is necessarily root at this point, `VNC_USER` and `VNC_HOME` resolve to `root` and `/root`. As a result: - The VNC password and desktop configuration are created for root. - The VNC desktop is started as root. - The generated Chrome launcher is placed under `/root`. - Chrome runs in the root desktop session. - Chrome's process sandbox is explicitly disabled with `--no-sandbox`. - The persistent browser profile can contain authenticated cookies and other sensitive session data under root-owned storage. Running a remotely accessible graphical desktop and web browser as root substantially exceeds the minimum privileges needed for browser automation. Disabling Chrome's sandbo ...[truncated 1458 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: install.sh:47

Finding

VNC Service Is Started Without Enforced Loopback Binding or Transport Protection

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: package.json:18

Finding

NPM Install Lifecycle Hook Performs Broad Privileged Host Provisioning

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: install.sh:23

Finding

Chrome Repository Uses a Legacy Globally Trusted APT Key and HTTP Transport

Content

View full analysis

> /etc/apt/sources.list.d/google-chrome.list' apt-get update apt-get install -y google-chrome-stable ``` The same installation pattern is also documented in `SKILL.md:61-65` and `README.md:17-21`. ### Technical Analysis The installation process imports Google's signing key through the deprecated `apt-key` mechanism. Keys installed this way are broadly trusted by APT rather than being scoped to one repository. The repository entry also uses plaintext HTTP: ```text http://dl.google.com/linux/chrome/deb/ ``` APT package signatures provide integrity protection for correctly signed metadata and packages, so HTTP alone does not directly permit arbitrary unsigned package installation. However, plaintext transport enables observation, blocking, replay attempts, and interference with repository traffic. Globally trusting the imported key increases the impact if the key or another repository configuration is abused. The repository entry is appended every time the installer runs, which can also create duplicate source entries. ### Attack Path 1. The root installer downloads and globally trusts a third-party signing key. 2. It configures package retrieval over HTTP and updates APT metadata. 3. A network attacker can interfere with repository traffic, while compromise or misuse of the broadly trusted key can affect repository trust beyond the intended Chrome source. 4. A malicious package accepted by APT is installed through `apt-get` with root privileges. 5. Package maintainer scripts or binaries then execute with system-level access. A practical arbitrary-package comp ...[truncated 511 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (31)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Piping network-retrieved content directly into a privileged command is a classic chaining hazard because it removes inspection and verification steps before trust is granted. In this case, the chain is used to install package-signing trust material, so abuse could enable downstream supply-chain compromise.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md

vncserver :1 -geometry 1920x1080 -depth 24

# 3. 安装 Chrome
wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
sudo sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google-chrome.list'
sudo apt-get update
sudo apt-get install -y google-chrome-stable

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

Chaining a network fetch directly into sudo amplifies the blast radius of any compromise in the download source or network path because untrusted input is immediately consumed by a privileged trust-establishment command. In documentation intended for easy copy-paste execution, this pattern is especially dangerous because users are unlikely to inspect what they are trusting.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

vncserver :1 -geometry 1920x1080 -depth 24

# 5. 安装 Chrome
wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
sudo sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google-chrome.list'
sudo apt-get update
sudo apt-get install -y google-chrome-stable

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

bash

# 删除旧 Cookie
rm -rf ~/.config/openclaw-browser-openclaw

# 重新启动 Chrome，重新登录
export DISPLAY=:1

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

bash

# 删除旧 Cookie
rm -rf ~/.config/openclaw-browser-openclaw

# 重新启动 Chrome，重新登录
export DISPLAY=:1

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

bash

# 1. 安装 XFCE + VNC
sudo apt-get update
sudo apt-get install -y xfce4 xfce4-goodies tigervnc-standalone-server tigervnc-common

# 2. 设置 VNC

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

bash

# 1. 安装 XFCE + VNC
sudo apt-get update
sudo apt-get install -y xfce4 xfce4-goodies tigervnc-standalone-server tigervnc-common

# 2. 设置 VNC

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

bash

# 1. 安装 XFCE + VNC
sudo apt-get update
sudo apt-get install -y xfce4 xfce4-goodies tigervnc-standalone-server tigervnc-common

# 2. 设置 VNC

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

bash

# 1. 安装 XFCE + VNC
sudo apt-get update
sudo apt-get install -y xfce4 xfce4-goodies tigervnc-standalone-server tigervnc-common

# 2. 设置 VNC

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

This command pipes downloaded key material directly into a privileged trust-management command (wget ... | sudo apt-key add -), creating a risky trust-on-first-use pattern. If the download source, transport, or key handling is compromised, a malicious signing key could be installed and used to authorize attacker-controlled packages.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md

vncserver :1 -geometry 1920x1080 -depth 24

# 3. 安装 Chrome
wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
sudo sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google-chrome.list'
sudo apt-get update
sudo apt-get install -y google-chrome-stable

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

This line appends a repository definition using a root shell invocation, adding an external package source at system scope. While adding a repo is sometimes necessary, doing so without accompanying integrity and trust guidance increases the risk of users enabling an untrusted or intercepted source, which can lead to malicious package installation.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md

# 3. 安装 Chrome
wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
sudo sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google-chrome.list'
sudo apt-get update
sudo apt-get install -y google-chrome-stable

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation combines --remote-debugging-port=18800 with a persistent --user-data-dir but provides no warning about the sensitivity of the DevTools interface or stored browser state. If the debugging port is reachable by other users or networks, an attacker may inspect pages, extract cookies/session tokens, control the browser, and access persisted profile data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README explicitly instructs launching Chrome on a server with --no-sandbox, which disables a major browser isolation control. In a browser automation context that may visit untrusted pages, this materially increases the risk that a renderer compromise could lead to host compromise, making the setup especially dangerous on multi-user or exposed servers.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

Piping a downloaded signing key directly into a privileged command reduces opportunities for verification and teaches an unsafe trust pattern. If the transport, source, or key distribution path is compromised, the user may grant trust to malicious packages with root privileges.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

vncserver :1 -geometry 1920x1080 -depth 24

# 5. 安装 Chrome
wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
sudo sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google-chrome.list'
sudo apt-get update
sudo apt-get install -y google-chrome-stable

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Appending a repository definition to a root-owned sources file via sudo is normal mechanically, but here it adds an HTTP repository, which permits tampering with package metadata or downloads if transport protections fail. Because this directly influences future privileged package installation, the insecure repository configuration is risky.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

# 5. 安装 Chrome
wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
sudo sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google-chrome.list'
sudo apt-get update
sudo apt-get install -y google-chrome-stable

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The natural-language examples are broad enough that ordinary conversation could trigger browser actions such as opening sites, taking screenshots, or interacting with logged-in sessions. In a skill that persists cookies and operates authenticated browser profiles, accidental invocation could cause unintended data access or actions on third-party sites.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.

bash

# 添加 cron 任务
crontab -e

# 每天 9 点执行
0 9 * * * openclaw browser --browser-profile openclaw open https://www.douyin.com

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

md

echo "🚀 开始安装 Server Browser Automation Skill..."

# 检查是否 root 或 sudo
if [ "$EUID" -ne 0 ]; then
  echo "❌ 请使用 sudo 运行此脚本"
  exit 1

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

md

echo "🚀 开始安装 Server Browser Automation Skill..."

# 检查是否 root 或 sudo
if [ "$EUID" -ne 0 ]; then
  echo "❌ 请使用 sudo 运行此脚本"
  exit 1

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

echo "🚀 开始安装 Server Browser Automation Skill..."

# 检查是否 root 或 sudo
if [ "$EUID" -ne 0 ]; then
  echo "❌ 请使用 sudo 运行此脚本"
  exit 1

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

echo "🚀 开始安装 Server Browser Automation Skill..."

# 检查是否 root 或 sudo
if [ "$EUID" -ne 0 ]; then
  echo "❌ 请使用 sudo 运行此脚本"
  exit 1

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

echo "🚀 开始安装 Server Browser Automation Skill..."

# 检查是否 root 或 sudo
if [ "$EUID" -ne 0 ]; then
  echo "❌ 请使用 sudo 运行此脚本"
  exit 1

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

echo "🚀 开始安装 Server Browser Automation Skill..."

# 检查是否 root 或 sudo
if [ "$EUID" -ne 0 ]; then
  echo "❌ 请使用 sudo 运行此脚本"
  exit 1

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 8)May include surrounding context.

sh

echo "🚀 开始安装 Server Browser Automation Skill..."

# 检查是否 root 或 sudo
if [ "$EUID" -ne 0 ]; then
  echo "❌ 请使用 sudo 运行此脚本"
  exit 1

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 10)May include surrounding context.

sh

echo "🚀 开始安装 Server Browser Automation Skill..."

# 检查是否 root 或 sudo
if [ "$EUID" -ne 0 ]; then
  echo "❌ 请使用 sudo 运行此脚本"
  exit 1

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script requires root execution, then derives VNC_USER from whoami, which under sudo/root will resolve to root rather than the intended non-root desktop user. This causes VNC configuration, password setup, and browser profile state to be created under root's account, undermining the stated security model and increasing the chance of an exposed privileged browser session.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.