ClawHub
Back to skill

Security audit

Agent Browser Stagehand

Security checks for vulnerabilities and agentic risk

Overview

This browser-automation skill is not clearly malicious, but it asks for broad browser, file, and command authority without enough scoping or user-control guidance.

Review this skill carefully before installing. Use it only in a restricted environment, avoid logged-in or sensitive websites unless you explicitly intend that access, do not provide secrets unless necessary, and require confirmation before it runs commands, writes files, changes proxy/user-agent settings, or performs bulk extraction.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The skill claims command execution is restricted to a whitelist and avoids user-input command construction, yet elsewhere advertises natural-language-driven CLI/browser actions and command execution. This inconsistency can mislead operators and downstream agents into trusting unsafe execution paths, increasing the risk of arbitrary command execution or unsafe browser actions based on untrusted prompts.

Intent-Code Divergence

Medium
Confidence
80% confidence
Finding
The document mixes browser automation with unrelated translation/localization use cases, creating ambiguity about the skill’s true scope and expected data flows. In security-sensitive agent systems, unclear scope can cause the skill to be invoked in unintended contexts, exposing data to tools or behaviors the user did not mean to authorize.

Vague Triggers

High
Confidence
93% confidence
Finding
The invocation trigger is extremely vague ('Use when the user asks'), which is dangerous for a skill with browser automation and exec capability. Overbroad triggers can cause automatic selection in contexts involving sensitive sites, credentials, or untrusted instructions, leading to unsafe navigation, data extraction, or command execution.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill exposes high-risk capabilities—browser automation, proxy configuration, user-agent control, extraction, screenshots, and command execution—without a prominent warning about abuse potential. Absent clear warnings and guardrails, users or orchestration layers may treat it as routine automation and unintentionally authorize sensitive actions on external sites or local systems.

Static analysis

No suspicious patterns detected.