ClawHub
Back to skill

Security audit

浏览器会话(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill matches its stated purpose, but it gives an agent broad Docker/browser command authority without enough safeguards for private sites, credentials, or unsafe shell execution.

Install only if you are comfortable letting an agent run Docker/browser commands locally. Use it with trusted public URLs, avoid internal/admin/metadata addresses, do not enter real credentials unless explicitly intended, and treat snapshots or page_content.txt as potentially sensitive files that should be redacted or deleted.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:80
Finding

Host Command Injection Through an Unsafely Constructed Shell Command

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:93
Finding

Unrestricted Browser Navigation Enables Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The capability table states '会话持久化' and '批量会话管理' are not supported in the free version, implying limited or no session-oriented management beyond one-off fetches. However, later code examples implement SessionLister.list_sessions() and show_session() to enumerate and inspect sessions, which contradicts the stated limitation and expands the apparent free-version functionality.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The input schema documents callback_url as an accepted parameter for asynchronous completion callbacks, which is functionally a notification/webhook mechanism. This directly conflicts with the later '已知限制' section that says webhook notifications are not supported in the free edition.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
86% confidence
Finding

The code builds a shell command that causes a process inside the container to make HTTP requests to localhost ports in order to probe CDP availability. Although targeted at loopback inside the container rather than arbitrary external hosts, it still normalizes internal network probing behavior and, combined with shell execution, expands the attack surface for scanning or interacting with services that should remain isolated.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md
"""查找可用的CDP端口"""
        for port in range(start, start + max_try):
            check_cmd = f"docker exec {self.container} python3 -c \"import urllib.request; " \
                       f"urllib.request.urlopen('http://localhost:{port}/json/version', timeout=2)\""
run(check_cmd, shell=True, capture_output=True)
            if result.returncode != 0:
                return port

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill declares very broad, vague scope keywords spanning coding, debugging, deployment, and general automation, which can cause the agent to invoke this skill in contexts unrelated to safe browser-session tasks. Over-broad routing increases the chance that sensitive user requests are funneled into a skill that performs browsing, form interaction, local command execution, and content capture without clear boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill demonstrates login-page interaction and content extraction without any warning about handling credentials, personal data, session tokens, or consent. In agent environments, this can normalize collecting or automating access to sensitive web data and may lead users to expose secrets or capture authenticated content unintentionally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The display name, summary, and nearly all user-facing documentation are written in Chinese, while the skill also claims support for general AI agent platforms and broad developer scenarios. There is no indication that the locale is intentionally region-specific or that users can choose an alternate language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The documented command writes captured page content to a local file without warning that the output may contain personal data, secrets, or proprietary content. While low severity, this can lead to unintended local persistence of sensitive information in shared workspaces, repos, or logs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.