Security audit

Selenium Browser Control

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real browser automation tool, but it gives broad, under-scoped control over browsing, cookies, JavaScript, screenshots, proxying, and weakened browser isolation.

Review before installing. Use this only in an isolated environment and avoid sensitive or logged-in websites unless you explicitly intend the agent to see or change that session. Be especially cautious with JavaScript execution, cookie commands, proxy/user-agent changes, and screenshot filenames; the Chrome sandbox is disabled and screenshots may contain private page content.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/browser_ctrl.py:30
Finding: Chrome Browser Sandbox Is Disabled
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/browser_ctrl.py:88
Finding: User-Controlled Screenshot Filename Allows Writes Outside the Intended Directory
Content: View full analysis
2 else None result = browser.screenshot(filename) ``` ### Technical Analysis The Skill documents screenshot storage under `~/Pictures/OpenClaw`, but it does not validate that the caller-supplied filename remains inside that directory. Python's `os.path.join` does not enforce containment. If `filename` is absolute, it can replace the preceding base directory. A value containing parent-directory components such as `../../target` can also resolve outside `SCREENSHOT_DIR`. The resulting content is generated PNG data, which limits direct script or configuration injection. Nevertheless, an attacker who can influence command arguments can create or overwrite any file writable by the Skill's operating-system account. Existing writable files may be corrupted, and specially selected locations could affect applications that automatically process image files. ### Attack Path 1. An attacker obtains control over, or influences, the filename passed to the `screenshot` command. 2. The attacker supplies an absolute path or a traversal path, such as `/tmp/target.png` or `../../target.png`. 3. `os.path.join(SCREENSHOT_DIR, filename)` produces a path outside the documente ...[truncated 854 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:62
Finding: Selenium Dependency Is Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises capabilities to read cookies, page source, links, images, and execute arbitrary JavaScript or modify browser state, but it provides no privacy, consent, or security warnings. In context, this is more dangerous because the skill is a browser automation tool with direct access to potentially sensitive authenticated sessions and can alter request behavior via cookies, user-agent, and proxy settings.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are very broad and include common terms like '浏览器', '点击', and '填写', which can cause the skill to be invoked in ordinary conversations unrelated to explicit browser automation. Because this skill can open pages, execute JavaScript, manipulate cookies, and use proxies, ambiguous invocation materially increases the chance of unintended execution and unsafe browsing actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code creates a persistent output directory and later saves screenshots and exported page artifacts into it, which can capture sensitive page contents or user data. Although the methods have internal docstrings, there is no visible confirmation prompt or user-facing disclosure when these file-writing operations occur from the CLI.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The driver initialization deliberately hides automation by disabling webdriver indicators and injecting a script to mask navigator.webdriver. In an agent skill, anti-detection measures increase the risk of covert browsing, bypass of bot protections, and use against sites in ways the stated automation purpose does not justify.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: execute_script accepts arbitrary JavaScript and runs it in the current page context, enabling state-changing actions, data extraction, and interaction with authenticated sessions. In combination with open_url, click, fill, and submit, this gives a caller broad power to perform covert actions on behalf of the user.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: get_cookies returns the full browser cookie jar for the active site without any filtering, redaction, or access control. In an agent context this can expose session tokens and authentication material, enabling account hijacking or unauthorized reuse of authenticated sessions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The method is documented as "导出 PDF" and returns a filesystem path, implying it creates a PDF at that location. In reality, it only executes window.print() and never writes or verifies a PDF file at filepath, so the documentation and returned result materially misrepresent the side effect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Nearly all descriptive content, commands context, and operational notes are presented only in Chinese, with no indication of language options or opt-in. This can violate language/locale policy where skills should not force a specific language absent documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The module documentation and user-facing strings are written in Chinese, which imposes a specific language without any opt-in or explanation of a region-specific requirement. This can violate language/locale policy expectations when users are not given a choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.