Page Agent Claw Controller

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:21 AM UTC
• Version: 0.1.1

Overview

This skill is a browser-automation bridge that is coherent in purpose, but it gives a local service broad free-form control of a user's browser without enough scoping or consent guidance.

Install only if you trust the page-agent-claw npm package, the local service, and the Chrome extension. Use it for explicit browser-automation tasks, avoid sending secrets or sensitive account workflows through free-form task prompts, and consider pinning/auditing the npm package before global installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:91
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, line 91 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown - page-agent-claw: `npm install -g page-agent-claw` ``` ### Technical Analysis The skill instructs users to install the `page-agent-claw` package globally without specifying an exact version, a package integrity hash, or an audited lockfile. Consequently, the command resolves to whichever release is associated with the package's current npm distribution tag at installation time. The dependency's source code is not included in the audited project, so its installation scripts, transitive dependencies, and runtime behavior could not be verified. npm packages may execute lifecycle scripts during installation. If the package, a transitive dependency, its publisher account, or the relevant registry delivery path were compromised, following this instruction could execute attacker-controlled code locally. Global installation increases exposure by placing package executables and files in the configured global npm prefix. The exact privileges available depend on the account running npm; the reviewed instruction does not explicitly request administrator privileges. ### Attack Path 1. An attacker compromises the package publisher, a dependency publisher, or a future package release. 2. The attacker publishes a malicious version and causes the package's active npm distribution tag to resolve to it. 3. A user follows the documented `npm install -g page-agent-claw` instruction. 4. npm downloads the unpinned package and its dependency graph. 5. Malicious lifecycle code, if present, executes with the privileges of the invoking user. 6. The installed command may subsequently execute additional malicious behavior when the skill starts `page-agent-claw`. This is a supply-chain exposure rather than evidence that the current package release is malicious. ## ...[truncated 544 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version, for example `npm install --global page-agent-claw@1.0.0`, rather than relying on a mutable distribution tag. 2. Document the package's authoritative repository and verify that the published npm artifact corresponds to the reviewed source revision. 3. Provide an expected package or artifact integrity digest through a trusted channel and verify it before installation. 4. Prefer a project-local dependency with a committed lockfile over global installation, then invoke it through a controlled project script. 5. Audit direct and transitive dependencies and continuously monitor them for known vulnerabilities and unexpected ownership or release changes. 6. Disable npm lifecycle scripts during installation with `--ignore-scripts` when they are not required. If lifecycle scripts are necessary, document and review each script before allowing execution. 7. Run the service under a dedicated, unprivileged account or isolated environment with narrowly scoped filesystem, browser, and network access. 8. Avoid using administrator or root privileges for package installation or service execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill’s activation condition is broader than the explicit keyword "page-agent" and also triggers whenever a task "needs a local browser," which can cause the agent to invoke this skill in many unrelated situations. Because the skill sends arbitrary natural-language tasks to a localhost browser automation service, over-broad routing increases the chance of unintended browser actions, navigation to attacker-controlled sites, or exposure of local browsing context to an unnecessary privileged tool.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 检查服务是否运行
curl http://localhost:4222/health

# 如未运行，启动服务
page-agent-claw

• Confidence: 88% confidence
• Finding: The skill instructs the agent to POST arbitrary user-supplied tasks to a locally running service at http://localhost:4222/api/task, which is an external process boundary even though it is on localhost. This can transmit sensitive prompts or derived data to a separate browser-automation component with broad page interaction capability, and if that local service or extension is compromised or overly permissive, it can perform unintended actions in the user’s browser session.

Static analysis

No suspicious patterns detected.