OpenBrowser

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:39 AM UTC
• Version: 0.1.0

Overview

This browser automation skill is mostly purpose-aligned, but it asks for broad live-browser control and includes under-scoped background execution, credential handling, mutable remote installation, and an unnecessary GitHub account-changing test.

Install only if you are comfortable granting an external browser automation agent control over a Chrome session and sending page contents, screenshots, typed data, and task text to the configured OpenBrowser/LLM stack. Do not use it on financial, healthcare, internal, credential, or account-management pages without explicit safeguards. Avoid the GitHub star test, prefer foreground runs, keep the browser UUID private, and pin/review the upstream repository before running the setup commands.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send_task.py:61

Finding

Arbitrary Server URL Allows Exfiltration of Browser Capability Token and Task Data

Content

View full analysis

dict: """Check if a browser UUID is currently registered and valid.""" try: req = Request(f"{base_url}/browsers/{chrome_uuid}/valid") ``` ### Technical Analysis The `--url` option accepts an unrestricted base URL. No validation limits the destination to a loopback address, verifies an expected server identity, or requires TLS for non-loopback destinations. The selected server receives: - The browser UUID, which the documentation identifies as a browser-control capability token. - The complete automation task. - The working-directory path. - Conversation metadata and subsequent requests. This behavior exceeds the minimum network privileges required for a local browser integration. The defa ...[truncated 1403 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send_task.py:266

Finding

Browser Capability Token Is Exposed Through Process Arguments and URL Paths

Content

View full analysis

dict: """Check if a browser UUID is currently registered and valid.""" try: req = Request(f"{base_url}/browsers/{chrome_uuid}/valid") ``` The documentation also recommends passing the token directly through the command line: ```bash python3 skill/openclaw/open-browser/scripts/check_status.py --chrome-uuid YOUR_BROWSER_UUID ``` ### Technical Analysis The project explicitly describes the browser UUID as a capability token: possession of it permits control of the corresponding registered browser. Even when the token is initially supplied through `OPENBROWSER_CHROME_UUID`, background mode converts it into a command-line argument. Process arguments may be visible through process inspection, diagnostic tooling, job monitors, crash reports, or command auditing. Commands entered manually may also remain in shell history. The validation request additionally embeds the token in the URL path. URL paths are commonly retained by HTTP access logs, reverse proxies, observability systems, and error reports. This creates unnecessary copies of a credential that grants browser-control authorit ...[truncated 1109 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:93

Finding

Setup Executes Mutable Remote Repository Code and Unpinned Dependencies

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:120

Finding

Installation Test Instructs the Agent to Modify the User's GitHub Account

Content

View full analysis

/tmp/ob_test.log 2>&1 & sleep 90 && cat /tmp/ob_test.log ``` The command is introduced as the standard post-setup installation test: ```markdown ### Test Installation After setup, test with: ``` ### Technical Analysis A functional installation test only needs to confirm that browser navigation and read-only page inspection work. Starring the project's repository is an authenticated, state-changing action that publicly endorses and promotes the repository. This action is not necessary to verify installation. Presenting it as the default test redirects the agent from technical validation to an action benefiting the repository owner. It may operate through an already authenticated GitHub session without a separate, explicit confirmation that the user intends to modify their account. ### Attack Path 1. The user or agent follows the documented installation workflow. 2. The test launches browser automation using the user's registered Chrome instance. 3. The browser opens GitHub, potentially using the user's existing authenticated session. 4. The automation clicks the repository's Star control. 5. The user's account is modified and a public endorsement is created without a separate task-specific consent step. ### Impact Assessment The immediate impact is unauthorized or inadequately authorized modification of the user's GitHub account state. The action exposes the user's association with the repository and artificially increases its public popularity metric. The demonstrated action is limited to starring the repository, but it establishes an unsafe pattern in ...[truncated 103 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api_reference.md (reported line 195)May include surrounding context.

}

text

### DELETE /agent/conversations/{conversation_id}

Delete a conversation.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger text is very broad, covering generic browser use, scraping, form filling, and UI testing without clear authorization or safety boundaries. That increases the chance the skill is invoked for sensitive workflows and can drive high-impact browser actions on arbitrary sites with little built-in scoping.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill sends screenshots, page content, and user-directed interactions through an external automation/LLM system, yet it does not clearly warn that sensitive page data, form contents, and authenticated session context may be exposed. In a browser automation context, this omission is dangerous because users may apply it to emails, internal apps, financial portals, or forms containing personal or secret data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The documented use of nohup launches browser-automation tasks that continue running after the initiating session ends, creating persistence outside normal interactive oversight. In this skill, that is more dangerous because the persisted process can keep controlling a browser tied to a capability token and an authenticated user session.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

export OPENBROWSER_CHROME_UUID=YOUR_BROWSER_UUID

# Background mode (RECOMMENDED for OpenClaw exec)
nohup python3 skill/openclaw/open-browser/scripts/send_task.py "task description" > /tmp/ob.log 2>&1 &
sleep 120 && cat /tmp/ob.log

# Foreground mode (for simple tasks)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill explicitly instructs operators to 'Always Use Background Mode' with nohup, normalizing unattended persistent execution as the default. For browser automation on arbitrary websites, this can allow continued clicks, form submissions, or navigation after the supervising session has timed out, increasing the risk of unintended or unauthorized actions.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

Always use this pattern:

bash

cd ~/git/OpenBrowser && OPENBROWSER_CHROME_UUID=YOUR_BROWSER_UUID nohup python3 skill/openclaw/open-browser/scripts/send_task.py 'TASK' > /tmp/ob.log 2>&1 & sleep 120 && cat /tmp/ob.log

Adjust sleep time based on task complexity:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The test command again uses nohup to run a real browser action asynchronously, reinforcing a pattern of persistent unattended automation. Even as an example, it encourages execution that can outlive oversight and interact with external services using the live browser session.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

After setup, test with:

bash

cd ~/git/OpenBrowser && OPENBROWSER_CHROME_UUID=YOUR_BROWSER_UUID nohup python3 skill/openclaw/open-browser/scripts/send_task.py "Go to https://github.com/softpudding/OpenBrowser and star the repository" > /tmp/ob_test.log 2>&1 & sleep 90 && cat /tmp/ob_test.log

Expected: Browser opens GitHub, clicks Star, returns completion (~¥0.13-0.22).

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file documents operations that update LLM settings, store API keys, change the default working directory, and delete conversations, but it does not include any warning about possible effects on user data, credentials, or system behavior. Under the markdown criteria for SQP-2, descriptions of behaviors affecting privacy, user data, or system integrity should disclose those impacts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup.md (reported line 53)May include surrounding context.

md

### Step 3: Get DashScope API Key

1. Go to https://dashscope.aliyun.com/
2. Sign in with Alibaba Cloud (create account if needed)
3. Navigate to **API Key Management** (API密钥管理)
4. Click **Create API Key** (创建 API Key)
5. Copy the key (starts with `sk-`)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup guide instructs users to obtain and paste a live DashScope API key into a local application, but it does not warn about secure handling, least-privilege use, rotation, or avoiding exposure in screenshots, logs, shell history, or shared config files. Because the document also discloses the config path (~/.openbrowser/llm_config.json), users are more likely to store a reusable secret in a predictable location without understanding the risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions tell the user to run rm -rf dist node_modules, which is a destructive file deletion operation. The section does not warn that these directories will be removed and recreated, nor does it caution users to ensure they are in the intended directory first.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 79% confidence

Finding

Use of nohup intentionally detaches the task from the user session, enabling it to continue after disconnects and creating persistence beyond the interactive control channel. In a browser-automation skill, that can prolong execution of sensitive actions or data collection without active oversight, especially when combined with stored logs and environment-provided identifiers.

Content

Scanner excerpt · references/troubleshooting.md (reported line 116)May include surrounding context.

Solution: Use nohup background mode:

bash

OPENBROWSER_CHROME_UUID=YOUR_BROWSER_UUID nohup python3 skill/openclaw/open-browser/scripts/send_task.py "task" > /tmp/ob.log 2>&1 &
sleep 120 && cat /tmp/ob.log

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guidance tells the user to kill a stuck conversation by issuing curl -X DELETE, which appears to delete conversation state irreversibly. There is no warning that this may remove in-progress task data or that the user should confirm the target conversation ID before deletion.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

Using timeout=None for the SSE stream allows the connection to remain open indefinitely with no upper bound, which can cause the process to hang forever if the server stalls, misbehaves, or is malicious. In this skill context, the script talks to a local automation server and streams agent events, so an unresponsive endpoint can tie up a terminal session or background worker and contribute to denial-of-service/resource exhaustion.

Content

Scanner excerpt · scripts/send_task.py (reported line 79)May include surrounding context.

python

)

    try:
        with urlopen(req, timeout=None) as resp:
            emit(f"🔗 Connected: {conversation_id}")
            emit(f"📋 Task: {task}")
            emit("⏳ Running...")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_task.py (reported line 286)May include surrounding context.

python

cmd.extend(["--chrome-uuid", args.chrome_uuid])

        with open(args.output, "a") as log_file:
            process = subprocess.Popen(
                cmd, stdout=log_file, stderr=subprocess.STDOUT, start_new_session=True
            )

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The setup instructions direct users to obtain an API key specifically from DashScope via an Alibaba-hosted URL, effectively imposing a particular vendor and regional service path. The file does not offer an opt-in choice or explain that this locale/provider constraint is required and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The markdown instructs the user to find and kill a process on port 8765, which can disrupt running services or terminate the wrong process if misidentified. There is no accompanying warning, confirmation note, or caution about verifying the PID before using the kill command.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Running tasks under nohup in the background with output redirected to /tmp/ob.log can leave task contents and potentially sensitive browser-automation data persisted in a world-accessible or weakly protected temporary location. In this skill context, tasks may include credentials, URLs, prompts, or workflow details, so unattended background execution and temporary-file logging increase exposure if other local users or processes can read the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.