Security audit

LexMount Cloud Browser

Security checks for vulnerabilities and agentic risk

Overview

The package provides the advertised cloud browser connection with clear controls for authorization, website sessions, and persistent settings.

LexMount handles the remote browser and any website sessions you authorize. Use a trusted gateway because its OAuth identity is shared. When uninstalling, separately disable the saved MCP connection if you want access stopped. The clean advisory scan agrees with the inspected artifacts; remote server implementation is outside this package review.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: oauth-client.json:6
Evidence: "http://127.0.0.1:8989/oauth/callback"

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: openclaw.plugin.json:16
Evidence: "redirectUrl": "http://127.0.0.1:8989/oauth/callback",