Token Efficient Web Operations en

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:19 AM UTC
• Version: 1.0.1

Overview

The skill is openly aimed at UI testing, but it depends on an unpinned browser extension and gives CDP-based page mutation powers that need careful review before use.

Install only after reviewing the exact browser extension source you will load, preferably pinning a known commit yourself. Use a dedicated Chrome profile with no saved credentials or real sessions, restrict extension access to test domains, and avoid sensitive, financial, medical, government, login, payment, or production-data pages. Treat form submission, deletion, and credential-field writes as actions requiring explicit confirmation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:255
• Finding: Unpinned External Browser Extension Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:255-270` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: High ### Vulnerable Code ```bash # 1. Download source code git clone https://github.com/TangJing/openclaw_access_web_page_js.git cd openclaw_access_web_page_js # 2. Review source code (recommended) # Check for: # - Network request code # - Data exfiltration logic # - manifest.json permissions # 3. Install extension # Open chrome://extensions/ # Enable "Developer mode" # Click "Load unpacked", select project directory ``` ### Technical Analysis The Skill requires users to clone a separately maintained Chrome extension from a mutable Git repository and load it as an unpacked browser extension. The clone command does not pin a reviewed commit or release, and the instructions do not require signature or checksum verification. Because the external extension source is not included in the audited project, its behavior and the privacy guarantees asserted by `SKILL.md` cannot be independently verified as part of this audit. The recommendation to review the source is advisory rather than an enforced installation control. A mutable upstream dependency can change after the Skill itself has been reviewed. A compromise of the repository, maintainer account, release process, or distribution path could therefore cause users to install browser-executable code different from the version originally assessed. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or another part of the extension's distribution process. 2. The attacker modifies the extension on the repository's default branch. 3. A user follows the documented `git clone` command, which retrieves the current mutable revision rather than a known reviewed commit. 4. The user enables Chrome Developer Mode and loads the downloaded directory as an unpacked extension. 5. The modified extension executes with its declared bro ...[truncated 798 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the extension to an explicitly reviewed commit hash instead of cloning a mutable default branch. 2. Publish the expected commit identifier and a cryptographic checksum of the reviewed source archive. 3. Require checksum or signature verification before the extension is loaded. 4. Vendor the reviewed extension source into a controlled, versioned distribution when licensing and maintenance constraints permit. 5. Treat source review as a mandatory installation gate rather than an optional recommendation. 6. Document the minimum required Chrome permissions and reject revisions requesting additional host or privileged permissions. 7. Restrict extension host access to explicit test domains and deny access to unrelated websites. 8. Use a dedicated browser profile containing no real credentials, authenticated sessions, personal information, or production data. 9. Re-audit every dependency update before changing the pinned revision. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:133
• Finding: Unescaped Values in CDP JavaScript Templates Can Enable Page-Context Code Injection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:133-159` **Vulnerability Type**: JavaScript injection through unsafe expression construction **Risk Level**: High ### Vulnerable Code ```javascript const results = ElementCollector.searchElementsByKey('{button-keyword}'); const element = Object.values(results)[0]; if (element) element.click(); ``` ```javascript const inputs = ElementCollector.searchElementsByKey('{search-box/input}'); const input = Object.values(inputs)[0]; if (input) { input.value = '{value}'; input.dispatchEvent(new Event('input', { bubbles: true })); } ``` ```javascript const selects = ElementCollector.searchElementsByKey('{selector-keyword}'); const select = Object.values(selects)[0]; if (select) { select.value = '{option-value}'; select.dispatchEvent(new Event('change', { bubbles: true })); } ``` ### Technical Analysis The operation templates place variable keywords and values inside single-quoted JavaScript literals intended for execution through CDP. The documentation does not require escaping, serialization, type validation, or structured argument passing. If an implementation replaces placeholders through direct string interpolation, a value containing a quote and JavaScript syntax can terminate the intended literal and append a new expression. CDP `Runtime.evaluate` would then execute the injected expression in the current page's JavaScript context. The templates are documentation rather than an implementation, so exploitation depends on the consuming agent constructing expressions through literal substitution. Nevertheless, these are the prescribed implementation patterns and therefore promote an unsafe execution model. For example, an attacker-controlled value shaped like the following could escape a directly interpolated single-quoted assignment: ```text '; /* attacker-controlled page-context JavaScript */ // ``` This audit does not provide an operational payload. The essential issue is that untrust ...[truncated 1487 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never concatenate raw values into CDP JavaScript expressions. 2. Serialize every string value with a correct JavaScript serializer such as `JSON.stringify` before embedding it in an expression. 3. Prefer structured argument passing, such as calling a predefined function with CDP call arguments, so data is not parsed as source code. 4. Validate that keywords and form values have the expected type, length, and character constraints before use. 5. Keep selectors, keywords, and values as data throughout the execution pipeline. 6. Encapsulate CDP operations in a reviewed helper API that accepts structured parameters and performs serialization internally. 7. Add tests containing quotes, backslashes, line terminators, Unicode separators, and JavaScript-like strings to verify that they remain inert data. 8. Use an isolated browser profile and explicit domain allowlist to limit the consequences of any page-context injection. 9. Require confirmation before destructive or state-changing actions such as submission, deletion, or navigation. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Exfiltration Commands

High

• Category: Prompt Injection

Content

1. **Extension Level**:
   - ✅ Page JS Extension runs entirely in browser locally
   - ✅ Does not proactively send data to external servers
   - ✅ Data stored in memory, cleared when page closes

2. **Agent Level**:

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

External Transmission

Medium

• Category: Data Exfiltration

Content

1. **Extension Level**:
   - ✅ Page JS Extension runs entirely in browser locally
   - ✅ Does not proactively send data to external servers
   - ✅ Data stored in memory, cleared when page closes

2. **Agent Level**:

• Confidence: 86% confidence
• Finding: The skill explicitly acknowledges that the AI agent may send element data to LLM services, and those element keys can contain page text such as labels and innerText. Even if the extension avoids password fields, this can still transmit sensitive on-page content, internal application text, or personal data from non-password elements to external services, creating a real confidentiality risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Step 2: Install OpenClaw Skill

```bash
# 1. Create Skill directory
mkdir -p ~/.openclaw/workspace/skills/page-js-operation

# 2. Save this SKILL.md to the directory

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

mkdir -p ~/.openclaw/workspace/skills/page-js-operation

# 2. Save this SKILL.md to the directory
# Path: ~/.openclaw/workspace/skills/page-js-operation/SKILL.md

# 3. Refresh Skills
openclaw agent --message "refresh skills"

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Static analysis

No suspicious patterns detected.