ClawHub
Back to skill

Security audit

Browser Harness

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about controlling a logged-in browser, but its broad exec/CDP escape hatches and inconsistent safety and upgrade guidance need user review before installation.

Install only if you intentionally want an agent to control a real logged-in Chrome session. Use a dedicated Chrome profile, keep BH_PUBLIC_ONLY=1 for public browsing tasks, avoid exec/raw for sensitive sites, require explicit confirmation before writes/uploads/screenshots, and do not follow the @latest or curl | sh setup shortcuts without your own package-verification process.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
setup.md:24
Finding

Remote Installer Is Downloaded and Executed Without Integrity Verification

Content
View full analysis
/dev/null 2>&1; then warn "uv is not installed. Choose one:" printf " curl -LsSf https://astral.sh/uv/install.sh | sh\n" printf " brew install uv\n" fail "Install uv and rerun: scripts/run.sh setup" fi ``` ### Technical Analysis The installation documentation instructs users to pipe an HTTPS response directly into a shell. Although the URL is presented as the official `uv` installer and `run.sh` only prints the command rather than automatically executing it, users following the prescribed installation process execute code whose effective contents can change after this Skill has been reviewed. There is no version-pinned installer artifact, expected cryptographic digest, detached signature, or review step between retrieval and execution. HTTPS authenticates the current endpoint but does not make the returned script immutable. Compromise of the distribution endpoint, its deployment process, DNS/TLS trust chain, or an upstream account could therefore turn this installation step into arbitrary local code execution. This behavior is not necessary for the Skill's browser-automation functionality. `uv` can instead be installed through a trusted package manager or a downloaded, versioned artifact whose integrity is verified before execution. ### Attack Path 1. A user or Agent runs `scripts/run.sh setup`. 2. The wrapper detects that `uv` is absent and prints the `curl | sh` installation command. 3. The user follows the Skill's documented instructions. 4. The shell downloads the curren ...[truncated 715 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/lib/runner.mjs:277
Finding

One-Time URL Check Can Be Bypassed by Navigation Inside an Exec Snippet

Content
View full analysis
new RegExp(p.source, p.flags)); const __allow = ${allowLit}; const __internal = ["chrome://","about:","devtools://","chrome-untrusted://","chrome-extension://"]; const __isInternal = __url && __internal.some(p => __url.startsWith(p)); let __host = ""; try { __host = __url ? new URL(__url).hostname.toLowerCase() : ""; } catch {} if (__url && !__isInternal) { if (${PUBLIC_ONLY ? "true" : "false"}) { const __ok = __allow.some(d => __host === d || __host.endsWith("." + d)); if (!__ok) { process.exit(7); } } else { let __hit = null; for (const __pat of __patterns) { if (__pat.test(__url)) { __hit = __pat; break; } } if (__hit && !${ALLOW_SENSITIVE ? "true" : "false"}) { process.exit(7); } } } } `; ``` The `exec` body is then accepted unchanged: ```js function snippetForExec(snippet) { return snippet; } ``` ```js case "exec": return snippetForExec(need(args[0], "bhts snippet", 0)); ``` The policy executes only once before the arbitrary command: ```js const cmdSnippet = buildCommandSnippet(); const policy = buildPolicyPreamble({ urlArg: urlForPolicy() }); // First policy, then user command const fullSnippet = `${policy}\n${cmdSnippet}`; ``` The project's own examples demonstrate navig ...[truncated 2353 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/lib/runner.mjs:343
Finding

Exec Accepts Arbitrary JavaScript With Host-Process Privileges

Content
View full analysis
{}, ); ``` ### Technical Analysis The use of `execFile` with `shell: false` correctly prevents shell metacharacter injection into the outer process launch. It does not, however, constrain the contents of the `-c` argument: that argument is intentionally executable JavaScript accepted from the Agent. The resulting `bhts` process is ordinary local code running under the user's account, not an operating-system sandbox. Environment filtering limits inherited variables but does not establish filesystem, process, module-loading, or network isolation. Consequently, an attacker who influences the Agent-generated `exec` snippet may be able to exercise capabilities beyond browser automation, depending on the JavaScript execution context exposed by `bhts`. This conflicts with the narrow filesystem and networking scope declared in `config.json`. Subprocess separation protects the wrapper's own memory, but it does not enforce least privilege on the child or protect user-accessible host resources. ### Attack Path 1. An attacker controls or influences content consumed by the Agent, such as page text, task input, or a poisoned domain-skill. 2. That content causes the Agent to construct a malicious `scripts/run.sh exec ''` invocation ...[truncated 925 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
setup.md:86
Finding

Documentation Reintroduces Floating and Unreviewed Dependency Upgrades

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (23)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md
- 不在自己的 Node 进程内 dynamic import 任何第三方包。`bhts` 总是作为独立**子进程**启动（参见 `scripts/lib/runner.mjs` 的 `SAFE_LAUNCH` 注释块）；包内代码无法读到本 skill 进程的内存或 env。

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The exec subcommand directly returns user-supplied text as the snippet executed by bhts, giving the caller arbitrary code execution inside the privileged browser-harness context. Although this is intentionally designed and isolated into a subprocess, that subprocess still has access to the connected logged-in browser session and can bypass the typed wrapper restrictions of the safer subcommands, making it a real high-risk capability in this skill context.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · setup.md (reported line 82)May include surrounding context.

npm uninstall -g browser-harness-ts

残留

rm -rf ~/.cache/browser-harness/ # socket / pid / log rm -rf ~/.config/browser-harness/ # 配置（如果有）

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · setup.md (reported line 83)May include surrounding context.

npm uninstall -g browser-harness-ts

残留

rm -rf ~/.cache/browser-harness/ # socket / pid / log rm -rf ~/.config/browser-harness/ # 配置（如果有）

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · setup.md (reported line 82)May include surrounding context.

npm uninstall -g browser-harness-ts

残留

rm -rf ~/.cache/browser-harness/ # socket / pid / log rm -rf ~/.config/browser-harness/ # 配置（如果有）

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · setup.md (reported line 83)May include surrounding context.

残留

rm -rf ~/.cache/browser-harness/ # socket / pid / log rm -rf ~/.config/browser-harness/ # 配置（如果有）

text

## 升级

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The primary operational and safety instructions in the README are written in Chinese, including the high-risk warning and default defense posture. This imposes a specific language on users without stating that alternative language support is available or that Chinese is required for a justified region-specific reason.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill exposes high-risk shell and environment-driven capabilities to control a real logged-in Chrome instance, but it declares no explicit tool scope such as allowed-tools or permissions. Without a restrictive scope, an agent may invoke broader shell actions than intended, increasing the chance of arbitrary command execution, policy bypass, or misuse of the user's authenticated browser session.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The command descriptions and much of the manifest's natural-language text are written exclusively in Chinese, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking environment. Under the policy, forcing a specific language/locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The read/extraction examples encourage scraping content from logged-in sites such as Taobao/JD and Feishu without warning that the output may contain private, regulated, or business-confidential data. Because the tool operates against the user's real authenticated browser, these examples normalize exfiltration-prone workflows and could lead agents to collect sensitive data into files or downstream logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

These examples demonstrate state-changing actions in a real logged-in browser session, including starring a repo, creating a CRM customer, and uploading a file, without requiring explicit confirmation, authorization checks, or even a warning banner. In this skill's context—direct control of the user's authenticated Chrome session—copying these patterns into agent workflows can cause unauthorized writes, data creation, or file disclosure with the user's live privileges.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documented scripts/run.sh raw and especially exec escape hatch allow direct forwarding of arbitrary backend/browser-harness commands, which undermines the constrained 'LLM-friendly' command surface. Because this skill operates the user's real authenticated browser, such unrestricted execution materially increases the chance of prompt-driven misuse, safety-check bypass, and unauthorized state-changing actions on sensitive sites.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The reference explicitly exposes low-level bh.cdp(method, params?, sessionId?), which allows arbitrary Chrome DevTools Protocol calls beyond the documented safe/high-level actions. In this skill's context, the agent controls a real logged-in Chrome session, so unrestricted CDP access can bypass higher-level safety expectations, reach sensitive browser capabilities, and perform actions or data extraction not covered by the intended command model.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file-level security documentation says the policy gate provides 'sensitive-deny + BH_PUBLIC_ONLY', and the manifest claims default refusal of write operations on sensitive sites. In code, the preamble runs before nearly all non-exempt commands and exits on sensitive/public-only violations without distinguishing read-only from write actions, so operations like open, js, or screenshots are denied as well.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file's primary user-facing help text is written in Chinese, including usage, warnings, and safety guidance, with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking environment. This can violate organizational language/locale policy when users are not given an opt-in or alternative locale.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/run.sh (reported line 282)May include surrounding context.

sh
mkdir -p "$(dirname "$AUDIT_LOG")" 2>/dev/null || true
    printf 'ts=%s sub=stop host=- mode=daemon-stop denied=0 exit=0 argv_sha256=-\n' \
      "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$AUDIT_LOG" 2>/dev/null || true
    chmod 0600 "$AUDIT_LOG" 2>/dev/null || true
  fi
}

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/run.sh (reported line 340)May include surrounding context.

sh
mkdir -p "$(dirname "$AUDIT_LOG")" 2>/dev/null || true
    printf 'ts=%s sub=stop host=- mode=daemon-stop denied=0 exit=0 argv_sha256=-\n' \
      "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$AUDIT_LOG" 2>/dev/null || true
    chmod 0600 "$AUDIT_LOG" 2>/dev/null || true
  fi
}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The setup guide explains how to attach to a real logged-in Chrome instance over CDP and mentions storing a sessionId, but it does not present a clear security/privacy warning near those steps. In this skill’s context, that omission matters because attaching to a live browser can grant broad access to cookies, authenticated sessions, page content, and browser actions, increasing the chance of unsafe use or informed-consent failures.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file presents all instructional content in Chinese and does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. This can be a natural-language policy issue when a specific language is effectively forced without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The section is documented as a working example for element screenshots, but at L211 it uses el.scrollIntoView() outside the callback where el exists. This contradicts the example's apparent intent because the shown code would fail rather than perform the documented screenshot workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file contains multiple natural-language comments and user-facing strings in Chinese, including notes that LANG/LC_* affect output encoding and several mandatory error/help messages. This indicates the skill is effectively tailored to a specific language/locale without offering a documented user choice or opt-in, which matches the locale-policy violation category.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
15% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/run.sh (reported line 120)May include surrounding context.

sh
# 2. uv
  if ! command -v uv >/dev/null 2>&1; then
    warn "uv 未安装。任选一种:"
    printf "    curl -LsSf https://astral.sh/uv/install.sh | sh\n"
    printf "    brew install uv\n"
    fail "装好 uv 后重跑: scripts/run.sh setup"
  fi

External Script Fetching

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The guide recommends piping a remote script directly into the shell via curl | sh. If the remote host, network path, or TLS trust chain is compromised, users may execute arbitrary code immediately during installation.

Content

Scanner excerpt · setup.md (reported line 25)May include surrounding context.

  1. 检查 node 是否 ≥ 20.6.0；缺则提示去装 nodejs.org 或 nvm install 20
  2. 检查 uv 是否安装；缺则提示：
    bash
    curl -LsSf https://astral.sh/uv/install.sh | sh    # 官方
# 或
brew install uv                                     # macOS

Static analysis

No suspicious patterns detected.