ClawHub
Back to skill

Security audit

Use agentbrowser to convert html to image

Security checks for vulnerabilities and agentic risk

Overview

This image-rendering skill matches its stated purpose, but its shell wrapper can be abused to run arbitrary commands and it downloads an unpinned browser tool at runtime.

Install only after the maintainer removes eval, validates format and source inputs, pins or vendors agent-browser, and documents network access and temporary/output file behavior. Until then, avoid using this skill on untrusted URLs, HTML, file paths, or format values.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
src/main.sh:35
Finding

Arbitrary Command Execution Through Shell Command Injection

Content
View full analysis
"$TMP_HTML" TARGET_URL="file://${TMP_HTML}" else echo '{"status": "error", "message": "Invalid source_type. Must be url, file, or code."}' exit 1 fi # Construct agent-browser command chain # 1. Open URL # 2. Wait for network idle # 3. Take screenshot CMD="npx --yes agent-browser open \"$TARGET_URL\"" CMD="$CMD && npx --yes agent-browser wait --load networkidle" SCREENSHOT_CMD="npx --yes agent-browser screenshot" if [ "$FULL_PAGE" = "true" ]; then SCREENSHOT_CMD="${SCREENSHOT_CMD} --full" fi CMD="$CMD && ${SCREENSHOT_CMD} \"$OUTPUT_PATH\"" # Execute eval "$CMD" > /dev/null 2>&1 || { ``` ### Technical Analysis The script places attacker-controlled `SOURCE_CONTENT` into `TARGET_URL` and attacker-controlled `FORMAT` into `OUTPUT_PATH`. These values are interpolated into a single shell command string and subsequently passed to `eval`. The escaped quotation marks in the command string do not provide effective protection. `eval` causes the shell to parse the generated string a second time, allowing embedded quotation marks, command separators, substitutions, redirections, or other shell syntax supplied through an ...[truncated 1672 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
src/main.sh:64
Finding

Automatic Execution of an Unpinned Registry Package

Content
View full analysis
/dev/null 2>&1 || { ``` ### Technical Analysis The script runs `npx --yes agent-browser` without specifying a reviewed version or requiring a locally installed, lockfile-controlled dependency. If the package is absent from the local cache or installation, `npx` may resolve and download it from the configured package registry. The `--yes` option suppresses the normal installation confirmation. Consequently, the code executed by this skill is not completely represented by the audited project. Its effective behavior can change when registry resolution produces a different package version. A compromised package release, package registry, dependency chain, or registry configuration could result in arbitrary third-party code executing during normal skill use. The same package is invoked three times for opening the target, waiting for network idle, and taking the screenshot. ### Attack Path 1. The skill is invoked in an environment where `agent-browser` is not installed locally at a locked version. 2. `npx --yes` resolves the package through the configured npm registry. 3. The registry supplies the latest matching package rather than a version fixed during review. 4. If that package or its transitive dependencies have been compromised, malicious installation or runtime code is downloaded. 5. The downloaded code executes with the privileges and environment of the skill runner. Exploitation depends on compromise or ...[truncated 725 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · src/main.sh (reported line 75)May include surrounding context.

sh
# Execute
eval "$CMD" > /dev/null 2>&1 || {
    echo "{\"status\": \"error\", \"message\": \"Failed to execute agent-browser rendering chain. Command: $CMD\"}"
    [ -n "$TMP_HTML" ] && rm -f "$TMP_HTML"
    exit 1
}

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · src/main.sh (reported line 80)May include surrounding context.

sh
# Execute
eval "$CMD" > /dev/null 2>&1 || {
    echo "{\"status\": \"error\", \"message\": \"Failed to execute agent-browser rendering chain. Command: $CMD\"}"
    [ -n "$TMP_HTML" ] && rm -f "$TMP_HTML"
    exit 1
}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly accepts a url source type and uses a browser-based renderer, but the description and usage guidance do not warn that rendering remote content will cause outbound network requests. This can surprise users and agents, leading to unintended contact with attacker-controlled or sensitive internal endpoints, especially in environments where network access is privileged or monitored.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

When source_type is set to url, the script opens the supplied URL and waits for network activity to settle, which can transmit user/system metadata to external services. Although the code comments describe the steps, there is no user-facing disclosure, confirmation, or warning message that external network access will occur.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The script invokes npx --yes agent-browser without pinning an exact package version, so execution depends on whatever version the registry resolves at runtime. This creates a supply-chain risk: a compromised upstream release, typo-squatted package, or breaking update could cause arbitrary code execution in the context of the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script builds a shell command string containing attacker-controlled values such as SOURCE_CONTENT/TARGET_URL and OUTPUT_PATH, then executes it with eval. Because quoting is performed inside a constructed string, an attacker can inject shell metacharacters or embedded quotes to break out of the intended arguments and achieve arbitrary command execution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This second npx --yes agent-browser call also fetches or resolves an unpinned package at runtime. Repeated unpinned invocations expand the attack surface and make the skill dependent on mutable external code during execution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The screenshot command again relies on an unpinned agent-browser package via npx, which can result in execution of unexpected or malicious code if the upstream package changes. In a shell script that processes attacker-controlled input, runtime package resolution is especially risky because compromise yields code execution on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The script creates an output directory and writes the rendered image to a timestamped file under the current working directory. Although this is part of the implementation, there is no visible disclosure to the user before the file write occurs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

For source_type=code, the script creates a temporary HTML file and writes the provided content into /tmp before rendering. While the behavior is visible in code comments, there is no user-facing disclosure, prompt, or warning that the input will be stored on disk temporarily.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.