Page Agent Claw Controller

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:21 AM UTC
• Version: 0.1.1

Overview

This skill is a browser-automation bridge that is coherent in purpose, but it gives a local service broad free-form control of a user's browser without enough scoping or consent guidance.

Install only if you trust the page-agent-claw npm package, the local service, and the Chrome extension. Use it for explicit browser-automation tasks, avoid sending secrets or sensitive account workflows through free-form task prompts, and consider pinning/auditing the npm package before global installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:91

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 91
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- page-agent-claw: `npm install -g page-agent-claw`

Technical Analysis

The skill instructs users to install the page-agent-claw package globally without specifying an exact version, a package integrity hash, or an audited lockfile. Consequently, the command resolves to whichever release is associated with the package's current npm distribution tag at installation time.

The dependency's source code is not included in the audited project, so its installation scripts, transitive dependencies, and runtime behavior could not be verified. npm packages may execute lifecycle scripts during installation. If the package, a transitive dependency, its publisher account, or the relevant registry delivery path were compromised, following this instruction could execute attacker-controlled code locally.

Global installation increases exposure by placing package executables and files in the configured global npm prefix. The exact privileges available depend on the account running npm; the reviewed instruction does not explicitly request administrator privileges.

Attack Path

1. An attacker compromises the package publisher, a dependency publisher, or a future package release.
2. The attacker publishes a malicious version and causes the package's active npm distribution tag to resolve to it.
3. A user follows the documented npm install -g page-agent-claw instruction.
4. npm downloads the unpinned package and its dependency graph.
5. Malicious lifecycle code, if present, executes with the privileges of the invoking user.
6. The installed command may subsequently execute additional malicious behavior when the skill starts page-agent-claw.

This is a supply-chain exposure rather than evidence that the current package release is malicious.

...[truncated 544 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version, for example npm install --global page-agent-claw@1.0.0, rather than relying on a mutable distribution tag.
2. Document the package's authoritative repository and verify that the published npm artifact corresponds to the reviewed source revision.
3. Provide an expected package or artifact integrity digest through a trusted channel and verify it before installation.
4. Prefer a project-local dependency with a committed lockfile over global installation, then invoke it through a controlled project script.
5. Audit direct and transitive dependencies and continuously monitor them for known vulnerabilities and unexpected ownership or release changes.
6. Disable npm lifecycle scripts during installation with --ignore-scripts when they are not required. If lifecycle scripts are necessary, document and review each script before allowing execution.
7. Run the service under a dedicated, unprivileged account or isolated environment with narrowly scoped filesystem, browser, and network access.
8. Avoid using administrator or root privileges for package installation or service execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill’s activation condition is broader than the explicit keyword "page-agent" and also triggers whenever a task "needs a local browser," which can cause the agent to invoke this skill in many unrelated situations. Because the skill sends arbitrary natural-language tasks to a localhost browser automation service, over-broad routing increases the chance of unintended browser actions, navigation to attacker-controlled sites, or exposure of local browsing context to an unnecessary privileged tool.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill instructs the agent to POST arbitrary user-supplied tasks to a locally running service at http://localhost:4222/api/task, which is an external process boundary even though it is on localhost. This can transmit sensitive prompts or derived data to a separate browser-automation component with broad page interaction capability, and if that local service or extension is compromised or overly permissive, it can perform unintended actions in the user’s browser session.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

bash

# 检查服务是否运行
curl http://localhost:4222/health

# 如未运行，启动服务
page-agent-claw

Static analysis

No suspicious patterns detected.