ClawHub
Back to skill

Security audit

Browser Automation

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent browser automation tool, but it needs Review because its installer can execute mutable remote code and its runtime can retain or access sensitive browser session data.

Review the install script before running it. Prefer preinstalling uv through a trusted package manager, pin bridgic-browser to a reviewed version, and run this in an isolated project or user/container. Use --clear-user-data or a separate BRIDGIC_HOME for sensitive browsing, avoid CDP against your everyday Chrome profile unless needed, and treat screenshots, storage files, and network captures as sensitive.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/install-deps.sh:205
Finding

Unverified Remote Installer Scripts Are Executed Directly

Content
View full analysis
/dev/null; then echo "uv not found — installing ..." case "$(uname -s)" in CYGWIN*|MINGW*|MSYS*|Windows_NT*) powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex" \ || { echo "Error: uv installation failed on Windows." >&2; fail "uv_install_failed" 1; } ;; *) curl -LsSf https://astral.sh/uv/install.sh | sh \ || { echo "Error: uv installation failed." >&2; fail "uv_install_failed" 1; } ;; esac ``` ### Technical Analysis When `uv` is unavailable, the script retrieves an installer from `https://astral.sh` and passes the response directly to a command interpreter. The Unix branch uses `curl | sh`, while the Windows branch uses `irm | iex` together with an execution-policy bypass. No version pin, cryptographic checksum, digital-signature verification, or local review step is applied before execution. HTTPS protects the transport connection but does not ensure that the retrieved script is immutable or that a compromised upstream service cannot return altered commands. Although Astral is a recognized software vendor and automatic installation is convenient, immediate remote execution is not the minimum access necessary for the Skill. The installer could instead require a preinstalled `uv` binary or verify a versioned release artifact before executing it. ### Attack Path 1. A user follows the installation instructions in `SKILL.md` and invokes `scripts/install-deps.sh`. 2. The script determines that `uv` is not present in `PATH`. 3. An attacker compromises the upstream host, its deployment process, DNS or certificate trust path, or another component capable of altering the returned installer. 4. The a ...[truncated 1132 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/deps.ini:17
Finding

Runtime Package Is Installed Without an Exact Version Pin

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill presents itself primarily as a browser automation capability, but it also directs dependency installation, project initialization, pyproject modification, and browser binary setup. That mismatch is dangerous because users or orchestration systems may grant it for browsing tasks without realizing it can alter the local development environment and install software, creating a pathway for supply-chain or persistence-related risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill clearly instructs execution of shell commands, including an installation script, but declares no tool scope or allowed-tools restrictions. In practice this widens the skill's effective authority and makes it easier for the agent to invoke shell unexpectedly, increasing the risk of unauthorized command execution or environment changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation text is extremely broad ('any task requiring a real browser', 'general web automation', 'prefer this over WebFetch'), which can cause over-invocation on many generic tasks. Over-broad triggering increases exposure to a high-capability browser-and-shell workflow, including authenticated browsing, stealth behavior, and local environment setup, even when a lower-risk tool would suffice.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
- If exploration involves repeatedly clicking items in a list, you do not need to traverse every item (especially when the list is large).
- If login, verification, or authorization is required during exploration, pause and ask the user to complete it manually, unless the user explicitly provides instructions in the task.
- To avoid operating on websites too frequently, maintain human-like access intervals during both exploration and coding. You may simulate random wait times to reduce the risk of being blocked. Note: the `bridgic-browser wait` command parameter is in **seconds**, not milliseconds; for example, `bridgic-browser wait 2` or `bridgic-browser wait 3.2`.
- After finishing exploration and code writing, automatically run testing/validation.
- **CDP mode tab visibility**: when attached via `--cdp` to a user's running Chrome, `tabs` / `switch-tab` / `close-tab` only see pages bridgic itself opened (the initial blank tab plus anything spawned from it via `new-tab` or a click on a `target="_blank"` link). The user's other tabs are deliberately invisible to bridgic — never assume you can `switch-tab` into them. To work with such a tab, ask the user to navigate to it through bridgic, or use `new-tab <url>`.

## Reference Files

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill notes that browser profile data and sessions are persisted by default, but it does not surface this as a clear warning in the main description or require consent before use. That creates a privacy and credential-retention risk, especially for authenticated browsing, because cookies and session artifacts may remain on disk longer than the user expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide encourages use of network capture commands but does not warn that captured requests and responses can contain cookies, authorization headers, CSRF tokens, personal data, and internal service details. In a browser-automation skill that explicitly supports authenticated sessions and login-gated sites, this omission increases the chance that operators will collect, store, or share sensitive traffic unsafely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide states that the browser uses a persistent profile by default and that state survives across commands, but it does not clearly warn that cookies, local storage, and authenticated session state may be retained across runs. In this skill's context, which targets login-gated and stealth browsing workflows, that can lead to unintended account reuse, credential exposure, cross-task data leakage, or actions being performed under a prior user's session.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
93% confidence
Finding

The documented disable_security option explicitly allows disabling browser security protections. In the context of a browser automation skill that is used on arbitrary, dynamic, and login-gated sites, exposing a security-disabling flag materially increases the chance that users run sessions with weakened isolation, making exploitation by malicious web content more damaging.

Content

Scanner excerpt · references/env-vars.md (reported line 116)May include surrounding context.

md
| Key | Type / values | Notes |
|---|---|---|
| `enabled` | `true | false` | Default `true`. |
| `disable_security` | `true | false` | Disables security features (testing only). |
| `use_new_headless` | `true | false` | Default `true`. Use full Chromium binary with `--headless=new` instead of headless-shell. Only active when `enabled=true`, `headless=true`, and not using system Chrome (`channel`/`executable_path`). |
| `in_docker` | `true | false` | Auto-detected by default. |
| `permissions` | `string[]` | Default permissions for stealth context; top-level `permissions` overrides. |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file explains how to save and restore storage state, and notes that browser state is persisted by default in a user data directory. Because cookies, localStorage, and persistent profiles can contain sensitive authentication material, the skill description should clearly warn users about handling, securing, and reusing these files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script persists the value of BRIDGIC_DEV_INDEX directly into pyproject.toml. If that index URL contains embedded credentials or tokens, they will be written to disk in plain text, potentially committed to source control, exposed to other users on the system, or leaked through logs and artifacts. In a dependency installer for a browser automation skill, private package feeds are plausible, so this is a realistic secret-exposure risk rather than a theoretical one.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file includes example commands and SDK code that save a screenshot to logged-in.png, which affects local user data by writing browser-derived content to disk. The guide explains the mechanics of the operation but does not warn that screenshots may capture sensitive page contents or that the action creates a persistent file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language example sets locale to zh-CN and timezone_id to Asia/Shanghai, which can be read as prescribing a specific locale configuration. The file does not indicate that this is optional or user-selected, so it risks violating language/locale policy guidance.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The script downloads and immediately executes a remote shell installer via curl ... | sh, giving full code-execution rights to whatever is served from that URL at runtime. If the upstream server, network path, TLS trust chain, or distribution endpoint is compromised, an attacker can run arbitrary commands on the host during installation. Because this skill is specifically intended to set up powerful browser automation tooling, compromising the installer can directly yield a high-value execution environment.

Content

Scanner excerpt · scripts/install-deps.sh (reported line 213)May include surrounding context.

sh
|| { echo "Error: uv installation failed on Windows." >&2; fail "uv_install_failed" 1; }
            ;;
        *)
            curl -LsSf https://astral.sh/uv/install.sh | sh \
                || { echo "Error: uv installation failed." >&2; fail "uv_install_failed" 1; }
            ;;
    esac