ClawHub
Back to skill

Security audit

浏览器智能代理工具-免费版

Security checks for vulnerabilities and agentic risk

Overview

The skill is a browser automation guide, but it asks for broad execution capability, unpinned global package installation, and reusable browser session persistence without enough safeguards.

Review before installing. Use this only for browser automation tasks, pin and verify the agent-browser package where possible, avoid running dependency installation with elevated privileges, and treat saved state files, screenshots, and PDFs as sensitive because they may contain active sessions or private page data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:156
Finding

Unpinned Global Installation of an Executable npm Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 156-159
Vulnerability Type: Unpinned and insufficiently verified third-party executable dependency
Risk Level: Medium

bash
npm install -g agent-browser
agent-browser install
agent-browser install --with-deps

The same global installation recommendation is repeated at SKILL.md:312, while the system dependency installation command is repeated at SKILL.md:287.

Technical Analysis

The Skill directs the Agent or user to globally install the latest available release of agent-browser without specifying an exact version, package integrity value, trusted publisher identity, or reviewed lockfile. An npm package installation may execute package lifecycle scripts, and a global installation exposes the resulting executable across the user's environment.

The instructions then immediately execute the newly installed program. The install operation downloads an additional browser runtime, while install --with-deps may install or modify operating-system dependencies. Therefore, the effective code executed is not fully represented by the audited project and may change whenever the external package is updated.

This does not prove that the referenced package is malicious. The vulnerability is the absence of controls protecting the installation process against package compromise, publisher-account takeover, unexpected upstream changes, registry substitution, or dependency-chain compromise.

Attack Path

  1. An attacker compromises the npm package, one of its transitive dependencies, its publisher account, or the registry path used to resolve the package.
  2. The attacker publishes a malicious release under the package version selected by the unpinned installation command.
  3. A user or Agent follows the Skill and runs npm install -g agent-browser.
  4. Malicious package lifecycle code may execute during installation.
  5. The user or Agent subsequently i ...[truncated 1124 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin agent-browser to an exact, reviewed version rather than resolving the latest release.
  2. Document the expected package publisher, official registry, and package integrity information.
  3. Prefer a project-local dependency managed through a committed lockfile instead of a global installation.
  4. Verify downloaded package and browser artifacts against trusted checksums or signatures.
  5. Review package lifecycle scripts and disable them during installation where they are unnecessary.
  6. Run installation and browser automation under a dedicated, unprivileged account or isolated container.
  7. Do not use --with-deps automatically. Require explicit approval after documenting the operating-system packages and changes it will perform.
  8. Use an approved internal registry or dependency proxy with package allowlisting and malware scanning in managed environments.
  9. Regularly review and deliberately update the pinned version instead of accepting upstream changes automatically.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:240
Finding

Plaintext Persistence of Reusable Browser Authentication State

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 240-241
Vulnerability Type: Insecure storage of session cookies and browser storage
Risk Level: Medium

bash
agent-browser state save auth.json
agent-browser state load auth.json

Related state-loading examples also appear at SKILL.md:121 and SKILL.md:126, and persistent authentication state is recommended as a preferred practice at SKILL.md:267.

Technical Analysis

The Skill states that browser state persistence saves and loads cookies and storage. These data may include session cookies, bearer tokens, refresh tokens, anti-CSRF values, and other authentication artifacts. The example writes this state to a predictable plaintext file named auth.json.

The guidance does not require owner-only permissions, encryption, secure secret storage, a protected directory, source-control exclusion, restricted backup handling, token redaction, expiration controls, or deletion after use. As a result, authentication state may be exposed through permissive filesystem permissions, repository commits, workspace artifacts, backups, support bundles, or access by another local process.

Loading state from a relative path also creates a trust-boundary concern: if an attacker can replace the file in a shared or attacker-writable workspace, the browser may load attacker-controlled cookies and storage. The primary confirmed weakness, however, is that sensitive reusable authentication material is persisted without specified safeguards.

Attack Path

  1. A user or Agent authenticates to a website through the automated browser.
  2. The Skill's recommendation is followed and agent-browser state save auth.json writes cookies and browser storage to the current working directory.
  3. The state file remains unencrypted and is retained without restrictive access or lifecycle controls.
  4. Another local user, process, workspace consumer, backup recipient, or repository read ...[truncated 1174 chars]
Remediation
View remediation

Remediation Suggestions

  1. Avoid persisting authenticated browser state unless it is strictly necessary.
  2. Store state files in a dedicated private directory rather than the current working directory.
  3. Create stored state with owner-only filesystem permissions and verify permissions before loading it.
  4. Encrypt state at rest using an operating-system credential store, managed secret service, or keys kept separately from the file.
  5. Add browser-state filenames and patterns to source-control ignore rules and prevent their inclusion in logs, build artifacts, backups, and support bundles.
  6. Use separate, least-privileged accounts and state files for different automation tasks and environments.
  7. Minimize retention and securely delete state immediately after the workflow completes.
  8. Rotate or revoke exposed sessions and require reauthentication for high-risk operations.
  9. Validate that a state file is owned by the expected user and is not writable by untrusted users before loading it.
  10. Prefer short-lived, narrowly scoped automation credentials over persistent personal or administrative sessions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description states '支持中文交互' and the document consistently presents Chinese-language interaction as the default behavior, without offering users a language or locale choice. This can violate language/locale policy when a skill imposes a specific language without explicit user opt-in or justified regional scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill exposes state save/load plus screenshot and PDF export, which can capture cookies, local storage, account data, and sensitive page contents, but the user-facing sections do not prominently warn about those privacy and credential risks. In a browser automation context, persisted auth state and captured page artifacts are especially sensitive because they can enable account reuse, session theft, or unintentional retention of confidential information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger condition is overly broad, effectively suggesting use for any AI-model, agent, orchestration, or LLM-related task. In a skill with exec, browser, write, and state persistence capabilities, ambiguous invocation criteria can cause the agent to select this skill in inappropriate contexts and perform unnecessary browsing or command execution on sensitive tasks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is presented as a browser-automation CLI, but the efficiency/comparison sections advertise generic file parsing, API aggregation, and command execution capabilities that exceed the documented scope. This scope inflation can cause an agent to invoke the skill for tasks it was not designed to handle, increasing the chance of unsafe exec usage, data mishandling, or over-privileged behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

Line L318 says the skill requires no additional API key, while L319 immediately introduces remote browser services that do require API keys. This is not merely incomplete documentation; it creates a contradictory expectation about credential requirements for using the skill in supported configurations.

Content

No source excerpt is available for this finding.