ClawHub
Back to skill

Security audit

Agent Vision Scraper

Security checks for vulnerabilities and agentic risk

Overview

This skill is a browser automation scraper that openly tries to bypass anti-bot checks and solve CAPTCHAs, with several under-scoped security risks users should review before installing.

Install only if you have explicit permission to automate the target sites and are comfortable with CAPTCHA bypass capability. Do not pass a shared .env file, do not use real account credentials without strict isolation, bind VNC to localhost or require authentication, avoid sensitive pages because screenshots/page data may be sent to external AI services, and run it in a tightly isolated network/container environment.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
agent-scraper.js:12
Finding

Unrestricted Browser Navigation Enables Server-Side Access to Internal Resources

Content
View full analysis

Vulnerability Details

File Location: agent-scraper.js:12-13, agent-scraper.js:51-53
Vulnerability Type: Unrestricted URL navigation / browser-assisted SSRF
Risk Level: High

Vulnerable Code

js
const url = process.argv[2];
const userInstruction = process.argv[3];
js
console.log(`[+] 正在导航至: ${url}`);
await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 60000 });
await page.waitForTimeout(3000);

Technical Analysis

The destination URL is obtained directly from a command-line argument and passed to Playwright's page.goto() without validation. The implementation does not restrict schemes, approved hostnames, ports, resolved IP addresses, redirects, loopback addresses, link-local addresses, or private network ranges.

Because navigation originates from the browser's execution environment, a caller may use the tool to request resources reachable from the container or host network but not reachable from the public Internet. The AI-controlled browser can subsequently inspect and interact with the loaded page, increasing the risk that internal content will appear in the task result.

Attack Path

  1. An attacker or untrusted caller supplies a URL targeting a loopback, private-network, link-local, or cloud metadata address.
  2. The script accepts the URL without checking its scheme or resolved address.
  3. Chromium sends the request from the container's network context.
  4. If the resource is reachable, the page is made available to AgentBrowser.
  5. The supplied instruction directs the agent to inspect or interact with the internal resource.
  6. Retrieved content or operation results may be returned through the serialized agent result.

Redirects can also be used to bypass a superficial hostname-only policy unless every redirect destination is validated.

Impact Assessment

Exploitation may permit:

  • Discovery of internal web applications and network services ...[truncated 515 chars]
Remediation
View remediation

Remediation Suggestions

  • Accept only explicitly required schemes, preferably https:.
  • Implement an allowlist of approved destination domains rather than a denylist.
  • Resolve the hostname before navigation and reject loopback, private, link-local, multicast, reserved, and metadata address ranges for both IPv4 and IPv6.
  • Validate every redirect destination using the same policy.
  • Reject URLs containing embedded credentials or unexpected ports.
  • Apply container-level egress filtering so application validation is not the only control.
  • Run scraping jobs in an isolated network namespace with no access to internal services or cloud metadata.
  • Log normalized destinations and rejected navigation attempts without logging credentials.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
agent-scraper.js:32
Finding

Chromium Sandbox Is Explicitly Disabled While Browsing Untrusted Websites

Content
View full analysis

Vulnerability Details

File Location: agent-scraper.js:32-40
Vulnerability Type: Browser isolation and least-privilege failure
Risk Level: High

Vulnerable Code

js
const browser = await chromium.launch({ 
    headless: false, 
    args: [
        '--no-sandbox', 
        '--disable-setuid-sandbox',
        '--disable-dev-shm-usage', // 防止 Docker 内存溢出
        '--disable-blink-features=AutomationControlled'
    ]
});

Technical Analysis

The --no-sandbox and --disable-setuid-sandbox flags explicitly disable Chromium's process sandbox. That sandbox is a major defense-in-depth boundary between untrusted website content and the operating-system process running the browser.

This tool is specifically intended to visit arbitrary, potentially adversarial websites and bypass anti-automation controls. Disabling browser isolation in that threat model materially increases the consequences of a Chromium renderer, JavaScript engine, image parser, or browser-process vulnerability.

Docker does not replace the Chromium sandbox. A container may reduce the eventual blast radius, but compromised browser code can still access resources available inside the container, including environment variables, mounted files, browser session data, and reachable network services. The available project does not include the documented Dockerfile, so effective container user, capabilities, seccomp policy, and mount restrictions cannot be verified.

Attack Path

  1. An operator invokes the scraper against an attacker-controlled or compromised website.
  2. The website serves content that exploits a vulnerability in the deployed Chromium version.
  3. The exploit obtains code execution in a renderer or related browser process.
  4. Because Chromium's sandbox is disabled, the attacker encounters fewer isolation boundaries between the compromised browser component and the browser process's operating-system privileges. 5 ...[truncated 863 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove both --no-sandbox and --disable-setuid-sandbox.
  • Run Chromium as a dedicated, non-root user with a functioning user-namespace or setuid sandbox.
  • Use a container configuration compatible with Chromium sandboxing instead of disabling the control.
  • Drop all unnecessary Linux capabilities and enable no-new-privileges.
  • Apply an appropriately restrictive seccomp and AppArmor or SELinux profile.
  • Use a read-only root filesystem and avoid sensitive host mounts.
  • Isolate each browser job in an ephemeral container with tightly restricted network access.
  • Keep Chromium and Playwright security updates current and test sandbox operation during deployment.

T08 · Insecure Dependencies

Warning
Location
package.json:19
Finding

Unpinned Runtime Dependencies and Missing Lockfile Allow Unreviewed Package Changes

Content
View full analysis

Vulnerability Details

File Location: package.json:19-24
Vulnerability Type: Mutable third-party dependency resolution
Risk Level: Medium

Vulnerable Code

json
"dependencies": {
  "@vercel/agent-browser": "^1.0.0",
  "playwright-extra": "^4.3.6",
  "puppeteer-extra-plugin-stealth": "^2.11.2",
  "dotenv": "^16.4.5"
}

No package-lock.json, npm-shrinkwrap.json, or other dependency lockfile is present in the supplied project structure.

Technical Analysis

Every runtime dependency uses a caret range. A later installation can therefore resolve package versions different from those originally reviewed. Without a committed lockfile, transitive dependency versions are also not reproducibly constrained.

These packages execute in the Node.js process and therefore inherit its access to process environment variables, browser objects, files, and network connectivity. A compromised package release, compromised maintainer account, or unsafe future version accepted by the declared ranges could execute arbitrary code during installation, import, or normal use.

This finding establishes unsafe dependency pinning and reproducibility. The reviewed files do not prove that any currently named package is malicious.

Attack Path

  1. A future compatible package version or transitive dependency is compromised or unexpectedly introduces unsafe behavior.
  2. A user builds or installs the project without a lockfile.
  3. The package manager resolves the newer version permitted by the caret range.
  4. The new package code executes during installation or when imported by agent-scraper.js.
  5. Malicious code reads environment secrets, changes browser actions, accesses local files, or sends data over the network using the Node.js process's privileges.

Impact Assessment

Successful supply-chain compromise could provide arbitrary code execution with the privileges of the Node.js process. Potentially expo ...[truncated 402 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin reviewed direct dependencies to exact versions.
  • Generate, review, and commit package-lock.json.
  • Use npm ci in builds so installation fails if the manifest and lockfile differ.
  • Review lockfile changes as security-sensitive code changes.
  • Verify package provenance and registry integrity metadata.
  • Use automated vulnerability and malicious-package scanning in CI.
  • Disable unnecessary package lifecycle scripts where operationally possible.
  • Perform upgrades through a controlled process that reviews direct and transitive changes before deployment.

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:18
Finding

Documentation Injects the Entire Environment File into a High-Risk Browser Agent

Content
View full analysis

Vulnerability Details

File Location: skill.md:18, README.md:22, README.md:44-50
Vulnerability Type: Excessive secret exposure
Risk Level: Medium

Vulnerable Code

skill.md instructs users to run:

bash
docker run --rm --env-file .env -p 5900:5900 agent-scraper-image node agent-scraper.js

README.md repeats the pattern and describes an environment file containing credentials:

bash
docker run --rm --env-file .env -p 5900:5900 agent-scraper-image node agent-scraper.js "<URL>" "<INSTRUCTION>"
env
# Optional: LLM API configuration
OPENAI_API_KEY=sk-xxx
ANTHROPIC_API_KEY=sk-ant-xxx

# Optional: proxy configuration
HTTP_PROXY=http://proxy:8080
HTTPS_PROXY=http://proxy:8080

The application also loads local environment files:

js
dotenv.config();

Technical Analysis

Docker's --env-file .env option injects every variable in the selected file into the application process. It does not restrict exposure to the single provider credential required for a task. The code similarly invokes dotenv.config() without an explicit restricted configuration when run directly.

The process imports multiple third-party packages, launches an unsandboxed browser, and delegates page control to an AI browser agent. Supplying unrelated credentials to this process violates least privilege and increases the consequences of a dependency compromise, browser exploit, diagnostic dump, or accidental environment disclosure.

There is no evidence in the reviewed first-party code that it directly transmits these credentials. The vulnerability is the unnecessary breadth of secret availability.

Attack Path

  1. A user stores multiple provider keys or other credentials in a shared .env file.
  2. The documented command injects every entry into the browser-agent container.
  3. A compromised dependency, browser exploit, or other code executing in the Node.js proces ...[truncated 862 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not pass a general-purpose .env file to the container.
  • Supply only the specific credential required by the selected model provider.
  • Use short-lived, narrowly scoped tokens with spending and permission limits.
  • Prefer Docker secrets, orchestration secret mounts, or a dedicated secret manager over ordinary environment variables.
  • Separate provider configurations so OpenAI and Anthropic credentials are not simultaneously exposed when only one is needed.
  • Ensure secrets are not included in logs, browser-visible content, crash reports, or serialized results.
  • Run each task in an ephemeral container and clear browser profiles and temporary data afterward.
  • Document minimum required variables and reject unexpected sensitive variables where feasible.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (26)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

2. 运行

bash
docker run --rm --env-file .env -p 5900:5900 agent-scraper-image node agent-scraper.js "<URL>" "<INSTRUCTION>"

示例

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

2. 运行

bash
docker run --rm --env-file .env -p 5900:5900 agent-scraper-image node agent-scraper.js "<URL>" "<INSTRUCTION>"

示例

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The example instructs the agent to read a CAPTCHA and submit a hard-coded username and password to a website, normalizing automated credential use in combination with anti-bot evasion and external visual analysis. In this context, credentials may be entered into an environment with unauthenticated VNC exposure and possible screenshot exfiltration to third-party LLMs, increasing the chance of compromise or misuse.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

bash
# 登录带验证码的网站
docker run --rm --env-file .env -p 5900:5900 agent-scraper-image node agent-scraper.js \
  "https://example.com/login" \
  "查看页面，如果发现图形验证码，读出图片上的字母，并与账号 admin 和密码 123456 一起填入表单，点击登录。"

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code explicitly augments the agent’s instructions to detect, analyze, and solve graphical CAPTCHAs, then continue automation. CAPTCHA challenges are an access-control and anti-abuse defense; embedding automated solving behavior materially increases the likelihood of unauthorized scraping, account abuse, or evasion of site protections.

Content

No source excerpt is available for this finding.

Ssd 1

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The augmented system-style prompt reframes CAPTCHA solving as part of the core mission, steering the model to override normal caution around access-control challenges. Because this is embedded as higher-priority guidance, it increases the chance the agent will persist through defenses rather than respecting them.

Content

No source excerpt is available for this finding.

Ssd 4

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instruction flow treats CAPTCHA handling as a routine step in the task and directs the agent to solve the challenge before proceeding. This normalizes bypassing anti-abuse controls and operationalizes evasion, making the tool more effective for prohibited scraping or unauthorized access workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill describes stealth automation, CAPTCHA solving, and authenticated form submission but provides no warnings, restrictions, or abuse-prevention language. In this context, the omission is dangerous because the documented behavior directly enables bypass of site protections and account access workflows without any guardrails.

Content

No source excerpt is available for this finding.

Ssd 4

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly combines stealth browsing, visual CAPTCHA solving, and credentialed login submission into a step-by-step workflow for bypassing site protections. That is dangerous because it operationalizes anti-detection evasion and access to protected resources, which can facilitate unauthorized account access, scraping, and policy circumvention.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
76% confidence
Finding

The skill instructs launching the container with --env-file .env, which can expose secrets to the containerized process and any code it runs. In the context of a scraper designed for stealth automation and login workflows, passing a broad environment file increases the risk of unnecessary credential exposure, misuse, or exfiltration from inside the container.

Content

Scanner excerpt · skill.md (reported line 15)May include surrounding context.

Command Format:

bash
docker run --rm --env-file .env -p 5900:5900 agent-scraper-image node agent-scraper.js

Examples:

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The example combines .env secret injection with explicit login automation using hardcoded credentials and CAPTCHA solving. This is especially dangerous because it normalizes handling secrets inside a stealth automation tool intended to defeat site protections, increasing the likelihood of credential misuse, unauthorized access, or secret leakage.

Content

Scanner excerpt · skill.md (reported line 20)May include surrounding context.

Examples:

bash
docker run --rm --env-file .env -p 5900:5900 agent-scraper-image node agent-scraper.js "https://example.com/login" "查看页面，如果发现图形验证码，读出图片上的字母，并与账号 admin 和密码 123456 一起填入表单，点击登录。"

Build Image

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The README advertises VNC access on port 5900 with no password, enabling anyone with network access to observe and potentially interact with the browser session. Given this tool is designed for login automation, CAPTCHA solving, and scraping, an exposed unauthenticated VNC service could leak credentials, session cookies, screenshots of sensitive pages, and allow active hijacking of in-progress sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explicitly states that screenshots are sent to external LLM services for visual analysis, but it does not warn that those screenshots may contain sensitive data such as credentials, session tokens, personal information, or internal business data. In the context of a browser automation and scraping tool that logs into sites and solves CAPTCHAs, this omission is especially dangerous because users may unknowingly transmit regulated or confidential content to third-party providers.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script enables a stealth plugin and disables AutomationControlled indicators to reduce detectability of browser automation. While automation itself can be legitimate, adding fingerprint evasion without a narrowly documented compliance use case is a strong signal of intent to circumvent site bot detection and terms-based restrictions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The page and user instruction are handed to AgentBrowser.execute, which implies transmitting page-derived content and prompts to an external agent/LLM service, yet the user is not warned about data disclosure. This can leak sensitive page content, credentials, personal data, or proprietary information to third-party infrastructure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The invocation guidance is overly broad: it directs use of the tool for complex automation, scraping, and anti-bot scenarios without meaningful constraints, authorization checks, or safety boundaries. In context, that broad trigger materially increases the chance the agent will deploy the skill for unauthorized scraping, login automation, or CAPTCHA circumvention.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The browser context is hard-coded to use locale 'zh-CN', which imposes a specific language/locale behavior on all runs. The file does not offer opt-in, configuration, or justification for this locale restriction.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The dependency uses a caret version range, which allows automatic installation of newer compatible releases rather than a single immutable version. This increases supply-chain risk because a compromised upstream release or an unexpected breaking/security-relevant change could be pulled into builds without explicit review.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json
"author": "Tedtalk",
  "license": "MIT",
  "dependencies": {
    "@vercel/agent-browser": "^1.0.0",
    "playwright-extra": "^4.3.6",
    "puppeteer-extra-plugin-stealth": "^2.11.2",
    "dotenv": "^16.4.5"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The dependency uses a caret version range, so builds may resolve to different package versions over time. In a browser automation/scraping tool, this can silently introduce vulnerable or malicious upstream code into an environment that likely has network access and automation privileges.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "@vercel/agent-browser": "^1.0.0",
    "playwright-extra": "^4.3.6",
    "puppeteer-extra-plugin-stealth": "^2.11.2",
    "dotenv": "^16.4.5"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

This package is not pinned and is a stealth/anti-detection browser automation plugin, which raises the consequences of supply-chain compromise because the code will run inside a highly privileged automation context. If a malicious or compromised update were fetched, it could alter browser behavior, exfiltrate data, or abuse the scraping agent's capabilities.

Content

Scanner excerpt · package.json (reported line 24)May include surrounding context.

json
"dependencies": {
    "@vercel/agent-browser": "^1.0.0",
    "playwright-extra": "^4.3.6",
    "puppeteer-extra-plugin-stealth": "^2.11.2",
    "dotenv": "^16.4.5"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Using a version range for dotenv permits unreviewed upstream changes to enter the build. While dotenv itself is common, it often mediates access to sensitive configuration and secrets, so a compromised dependency could affect how environment variables are handled or exposed.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json
"@vercel/agent-browser": "^1.0.0",
    "playwright-extra": "^4.3.6",
    "puppeteer-extra-plugin-stealth": "^2.11.2",
    "dotenv": "^16.4.5"
  }
}

Static analysis

No suspicious patterns detected.