ClawHub
Back to skill

Security audit

Unbrowse for Gitlab (unofficial)

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly disclosed GitLab/Unbrowse integration, but it exposes broader authenticated browser automation and tool-compilation authority than its read-only GitLab description suggests.

Install only if you are comfortable giving a remote Unbrowse MCP service OAuth/API-key access and potentially authenticated GitLab browser automation. Treat it as a Review item rather than a simple read-only GitLab lookup skill, and require explicit confirmation before any login, tool-compilation fallback, or action that could modify GitLab account or project state.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest and top-level description present this as a read-only informational skill, but the workflow explicitly instructs the agent to use unbrowse.run and cloud-browser actions to compile new tools, and acknowledges that state-changing actions may occur. This creates a privilege-expansion path from a seemingly safe read-only integration into interactive browser automation that could modify account or site state.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

Although this is a documentation issue rather than code execution embedded in the repository itself, the skill context increases relevance because users are being told to fetch and run remote tooling directly. In an agent/tooling ecosystem, unpinned bootstrap commands are more dangerous than in passive documentation because they normalize executing mutable third-party code during setup.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill claims the MCP scope is limited to gitlab.com and that every call stays on gitlab.com, but it also advertises generic Unbrowse tools that can inspect, scrape, map, and drive a cloud browser. That mismatch can cause an agent or operator to over-trust the skill's safety boundary and invoke broader capabilities than the manifest suggests.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
86% confidence
Finding

The instruction to use browser autofill from a password manager enables the agent to initiate authenticated sessions without an explicit credential handoff in the moment. In the context of a skill that also exposes browser automation and tool-compilation flows, this increases the risk of autonomous authenticated actions occurring with insufficient user awareness or approval.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
1. Pick the tool whose title matches the job and pass its inputs. Leave the site's recorded parameters out unless the user asked for something they control.
2. Read `status`. `succeeded` carries the verified `result`. `input_required` is not a failure: answer the open fields with `unbrowse.resume {runId, answers}` on the same run.
3. No tool fits: `unbrowse.run {task}`. It fails with `no_capability` when nothing is compiled for that yet: do it once with `unbrowse.browse.open` on gitlab.com → `unbrowse.browse.act` → `unbrowse.browse.finish`, which compiles a new tool this server lists next time. Anything off gitlab.com is refused here (`not_in_scope`): use the general Unbrowse server for that.
4. Signing in: never ask the user for a password. `unbrowse.browse.act` with `action: "autofill"` fills gitlab.com's login from their Unbrowse password manager.
5. Report only what a `succeeded` result says. `outcome_unknown` means a change may have happened: check before retrying. Posting, buying, sending or deleting needs the user's go-ahead.

## Without MCP

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

Every tool is also a REST call:

sh
curl -s https://unbrowse.ai/api/v1/sites/about.gitlab.com/call/about_gitlab_com__get_pricing_payload_json \
  -H "authorization: Bearer $UNBROWSE_API_KEY" -H "content-type: application/json" \
  -d '{}'

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The line claims the server scope holds only gitlab.com and that every call stays on gitlab.com. Elsewhere in the file, first-class tools are defined for about.gitlab.com and docs.gitlab.com, so the statement is not accurate as written and contradicts the documented scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.