Testagent Browser Setup

• Outcome: Review
• Latest audit: Jul 23, 2026 · 10:13 AM UTC
• Version: 1.0.10

Overview

This browser setup skill is not clearly malicious, but it gives agents broad browser-control, session, network, and install capabilities with weak scoping and unsafe fallback guidance.

Review before installing. Only use this in an isolated test environment where direct CDP control, remote package installs, OpenClaw MCP configuration changes, and optional browser-use capabilities are explicitly approved. Avoid reusing real Chrome profiles or authenticated sessions, do not use tunnels or residential proxies without authorization, and treat any SSRF policy block as a security decision rather than something to work around.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill documentation directs the operator to execute shell scripts (`bash scripts/setup.sh`, optional additional setup scripts, and config/file copy commands) but does not declare corresponding permissions. That mismatch hides the true execution capability of the skill, reducing user awareness and review scrutiny before system-changing commands are run.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The stated purpose is limited to browser setup, but the broader behavior described by the finding includes installing additional external tooling from remote sources, adding packages, and modifying openclaw configuration. This is dangerous because reviewers and users may authorize a narrow environment bootstrap while actually permitting a larger supply-chain and persistence footprint.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The documentation instructs the operator to manually allowlist target and login domains in the browser SSRF policy and then suggests bypassing the built-in browser controls by switching to direct CDP if policy blocks navigation. This weakens defense-in-depth around outbound access and creates a path for browsing workflows to reach hosts that platform protections were intended to constrain.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The file's scope is far broader than a one-time local browser setup skill and includes operational guidance for browser automation, session reuse, tunneling, and direct CDP control. This materially increases the skill's capability surface and provides instructions that could be used to access authenticated sessions, internal resources, or bypass built-in protections unrelated to initial setup.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The documentation explicitly promotes cloud browser access, CAPTCHA/anti-bot handling, residential proxies, and internal network tunneling, all of which enable evasion, sensitive network reachability, and expanded collection capability beyond a setup task. In this skill context, these features are unjustified and meaningfully increase abuse potential.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The direct CDP section tells the operator to switch away from a browser path after a policy block and use a lower-level connection instead, which is effectively guidance to bypass an SSRF control. Providing step-by-step bypass instructions for a blocked security mechanism is highly dangerous because it can enable access to restricted endpoints and weaken platform-enforced safeguards.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The optional setup installs an additional third-party CLI and skill from outside the declared setup scope, expanding the trust boundary and attack surface of the environment. Because this extra software is not necessary for the main flow and is fetched from external sources, it creates supply-chain risk and can introduce unreviewed code into the agent environment.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script downloads and immediately executes remote code via a shell pipeline, which gives the remote host full ability to run arbitrary commands in the user's environment. This is especially dangerous here because the skill is described as environment setup, making users more likely to trust and run it automatically on fresh machines.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The trigger phrase `setup browser` is broad enough to match ordinary user requests that may not imply consent for system initialization, downloads, or configuration changes. In an agent setting, ambiguous activation can cause this skill to run unexpectedly and perform persistent local modifications.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs users to run setup scripts, edit `~/.openclaw/openclaw.json`, copy tooling files, start services, and optionally install more software, but it does not present an upfront warning summarizing these system changes. Lack of explicit notice undermines informed consent and increases the chance of operators making risky environment changes without understanding persistence, network, or security implications.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Recommending reuse of a user's local Chrome profile can expose authenticated sessions, cookies, saved credentials, and sensitive account data without any warning or consent boundary. In an agent skill, this creates a serious risk of unauthorized access to private resources under the user's identity.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The internal network tunnel guidance can expose local or private services to browser automation flows without explaining the sensitivity of internal resources or the risk of pivoting into protected environments. This is especially risky in a general-purpose agent skill because it may enable access to admin panels, metadata services, or non-public applications.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The workflow normalizes bypassing the built-in browser's SSRF restriction and offers no warning that the block is a security control. Omitting that warning while prescribing an alternate path increases the likelihood of unsafe use and directly undermines a protection intended to prevent access to sensitive internal or restricted targets.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The generated launcher starts Chromium with remote debugging enabled, --remote-allow-origins='*', and --no-sandbox, creating a broadly exposed local control surface for the browser. In a test-agent context this is more dangerous because CDP gives powerful browser control, and weak launch settings can let other local processes or reachable peers interact with the debugging endpoint and abuse the browser session.

Ssd 4

High

• Confidence: 99% confidence
• Finding: The wording does more than mention CDP; it actively steers the operator from a denied path to a lower-level mechanism specifically when a security policy blocks access. That progression is characteristic of defense subversion because it converts a control failure into instructions for circumvention.

Session Persistence

Medium

• Category: Rogue Agent

Content

# ── [2/3] Chrome CDP launcher script ──────────────────────
echo "=== [2/3] Creating chrome-cdp launcher ==="
mkdir -p "$HOME/.local/bin"
cat > "$HOME/.local/bin/chrome-cdp" << WRAPPER
#!/bin/bash
exec "$CHROME_BIN" \\

• Confidence: 91% confidence
• Finding: mkdir -p "$HOME/.local/bin" cat > "$HOME/.local/bin/chrome-cdp" << WRAPPER #!/bin/bash exec "$CHROME_BIN" \\ --headless=new \\ --no-sandbox \\ --disable-dev-shm-usage \\ --remote-debugging-por

External Script Fetching

High

• Category: Supply Chain

Content

# Failures here are non-fatal — main testing flow works without browser-use.

echo "=== [opt 1/2] Installing browser-use CLI ==="
curl -fsSL --retry 3 https://browser-use.com/cli/install.sh | bash || {
    echo "  ⚠ browser-use CLI install failed. Retry manually:"
    echo "    curl -fsSL https://browser-use.com/cli/install.sh | bash"
}

• Confidence: 99% confidence
• Finding: curl -fsSL --retry 3 https://browser-use.com/cli/install.sh | bash

External Script Fetching

High

• Category: Supply Chain

Content

echo "=== [opt 1/2] Installing browser-use CLI ==="
curl -fsSL --retry 3 https://browser-use.com/cli/install.sh | bash || {
    echo "  ⚠ browser-use CLI install failed. Retry manually:"
    echo "    curl -fsSL https://browser-use.com/cli/install.sh | bash"
}

echo "=== [opt 2/2] Installing browser-use skill ==="

• Confidence: 94% confidence
• Finding: curl -fsSL https://browser-use.com/cli/install.sh | bash

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.