Security audit

.Agent Browser Clawdbot.Disabled.20260401 112736

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent browser automation helper, but it needs review because it encourages persistent authenticated browser state and cookie/storage access without clear safeguards.

Review before installing. Use this only with trusted workflows, keep saved browser state files out of repositories and logs, store them like secrets, avoid saving privileged sessions unless necessary, delete them after use, and prefer isolated test accounts or containers for authenticated automation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:197
Finding: Unpinned Global Installation of a Third-Party Package and Browser Components
Content: View full analysis
Remediation: View remediation
``` 2. Record and verify package integrity, publisher identity, registry origin, and relevant release signatures or checksums. 3. Use a lockfile and a project-local installation instead of a global installation where practical. 4. Run the package in an isolated container, virtual machine, or restricted service account with no access to unrelated secrets. 5. Disable or review npm lifecycle scripts when the package supports installation without them. 6. Verify the provenance and checksum of downloaded Chromium artifacts. 7. Avoid `--with-deps` unless necessary. Review the exact system packages and commands involved before granting elevated privileges. 8. Document the expected npm registry and reject alternate or unexpected package sources. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:106
Finding: Authentication State Persisted to an Unprotected JSON File
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly recommends saving and reusing browser auth state files to skip login flows, but it does not warn that these files can contain session cookies, local storage tokens, and other authentication artifacts. In an agent context, this increases the risk that credentials are persisted insecurely, reused across tasks, exposed to other users/processes, or accidentally committed/shared, enabling account takeover or session hijacking.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill documents commands for reading and modifying cookies and localStorage without any caution about handling sensitive data or altering authenticated browser state. In a browser automation skill intended for AI agents, these capabilities can expose session identifiers, CSRF tokens, and private data, or let an agent tamper with security-relevant state in ways that bypass intended application flows.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.