Clawdbot Agent Browser
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This is a coherent browser-automation guide, but it relies on an external CLI and can handle authenticated browser state, so users should verify the tool and protect session files.
Install this only if you trust the external agent-browser npm package and repository. Treat auth.json, cookies, screenshots, PDFs, and extracted page content as sensitive, and ask for confirmation before letting the agent perform important actions on logged-in websites.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
An agent using this skill could submit forms, change settings, or interact with web apps on the user's behalf.
The skill exposes browser actions that can click, type, and modify mocked network responses. This is expected for browser automation, but it can cause real effects on websites if used on authenticated or production pages.
agent-browser click @e2
agent-browser fill @e3 "text"
agent-browser network route "**/api/*" --body '{"x":1}'Use it only for user-approved browsing tasks and require explicit confirmation before high-impact actions such as purchases, posts, deletions, or account changes.
Saved auth files could let someone reuse a logged-in browser session if the files are exposed.
The skill documents saving/loading cookies and storage and reading cookies. This is common for browser automation, but those files and values can represent authenticated account access.
agent-browser state save auth.json # Save cookies/storage agent-browser state load auth.json # Load (skip login) agent-browser cookies # Get all
Store auth state files securely, avoid committing them to projects, and use separate low-privilege/test accounts when possible.
Installing the CLI gives trust to the npm package and downloaded browser components outside this skill package.
The reviewed skill is instruction-only and directs users to install an external global npm CLI and browser dependencies. This setup is expected for the stated purpose, but the external package is not included in the scanned artifacts.
npm install -g agent-browser agent-browser install # Download Chromium agent-browser install --with-deps # Linux: + system deps
Verify the npm package and upstream repository before installing, consider pinning versions, and install only in an environment where browser automation dependencies are acceptable.