Testagent Browser Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:32 AM UTC
• Version: 1.0.10

Overview

The skill mostly matches browser setup, but it weakens browser/network safeguards and installs mutable third-party tooling, so it should be reviewed before use.

Install only in an isolated test container or after reviewing and pinning the third-party installs. Avoid running the optional browser-use installer as written, do not reuse personal Chrome profiles or real credentials, and do not use direct CDP to bypass network policy without explicit authorization.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup-optional.sh:5

Finding

Unverified Remote Installer Piped Directly into Bash

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/setup.sh:30

Finding

Unpinned Packages and Repository Content Execute During Setup and Future Tool Launches

Content

View full analysis

&1 | tail -5 CHROME_BIN=$(ls "$HOME/.cache/ms-playwright/chromium-"*/chrome-linux/chrome 2>/dev/null | head -1) ``` ```bash # ws module (the direct-CDP scripts use Node.js and need this package) echo "=== Installing ws (Node.js CDP WebSocket) ===" npm install -g ws 2>/dev/null || npm install --prefix "$HOME/.local/npm" ws 2>/dev/null || true # Register Playwright MCP echo "=== Registering Playwright MCP ===" openclaw mcp set playwright '{"command":"npx","args":["-y","@playwright/mcp","--headless","--browser","chromium"]}' 2>/dev/null || true ``` From `scripts/setup-optional.sh`: ```bash echo "=== [opt 2/2] Installing browser-use skill ===" npx skills add https://github.com/browser-use/browser-use --skill browser-use || { echo " ⚠ browser-use skill install failed. Retry manually:" echo " npx skills add https://github.com/browser-use/browser-use --skill browser-use" } ``` ### Technical Analysis The setup resolves and executes third-party packages without exact versions, lockfile integrity, or immutable repository revisions: - `npx @playwright/mcp` resolves an unspecified package version. - `npm install ... ws` installs an unspecified current version and may execute package lifecycle behavior. - The registered MCP configuration uses `npx -y @playwright/mcp`, so future launches may resolve changed upstream content, extending the supply-chain exposure beyond the initial setup. - `npx skills add` retrieves skill content from a mutable GitHub repository reference rather than a reviewed commit hash. These dependencies appear related to the declared browser functio ...[truncated 1456 chars]

Remediation

View remediation

` and `ws@`. 2. Use a project-local `package.json` and lockfile with integrity metadata rather than global installations. 3. Install with a deterministic command such as `npm ci` against a committed, audited lockfile. 4. Review dependency lifecycle scripts and disable them where they are unnecessary. 5. Pin GitHub content to an immutable commit SHA and verify that commit before installation. 6. Register the MCP server using a verified local executable instead of an unversioned `npx -y` command. 7. Avoid suppressing all dependency errors; fail closed and provide actionable diagnostics if installation or integrity verification fails. 8. Establish an update process in which version and integrity changes are reviewed before deployment. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/setup.sh:43

Finding

Direct CDP Launcher Bypasses SSRF Controls and Weakens Browser Isolation

Content

View full analysis

"$HOME/.local/bin/chrome-cdp" << WRAPPER #!/bin/bash exec "$CHROME_BIN" \\ --headless=new \\ --no-sandbox \\ --disable-dev-shm-usage \\ --remote-debugging-port=\${CDP_PORT:-9223} \\ --remote-allow-origins='*' \\ --user-data-dir=/tmp/chrome-cdp-profile \\ "\$@" WRAPPER chmod +x "$HOME/.local/bin/chrome-cdp" echo " ✓ chrome-cdp launcher created at ~/.local/bin/chrome-cdp" ``` The accompanying instructions explicitly recommend using this channel when the protected browser blocks navigation: From `SKILL.md:51-55`: ```markdown After editing: `browser stop → gateway restart → wait 15s → browser start` > ⚠️ **The SSRF allowlist often doesn't take effect** (the gateway has a runtime cache and doesn't always pick up the file). > If `browser navigate` still reports `blocked by policy`, **immediately abandon the built-in browser and switch to direct CDP (see TOOLS.md)** rather than continuing to restart-and-retry. ``` From `TOOLS.md:64-73`: ```markdown ## Direct CDP connection (the primary path when the built-in browser's SSRF check blocks you) The built-in browser's SSRF allowlist configuration often doesn't take effect (the gateway has a runtime cache, and writing to the file alone doesn't help). **As soon as `browser navigate` reports `blocked by policy`, switch immediately to direct CDP rather than continuing to restart-and-retry.** ### Start ```bash chrome-cdp & # ~/.local/bin/chrome-cdp, headless + CDP port 9223 sleep 2 curl -s http://localhost:9223/json # verify it's reachable ``` ``` ### Technical Analysis The launcher combines several security-reducing options: - `--no-sandb ...[truncated 2624 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill initializes a fresh openclaw environment with Chromium, system dependencies, Chinese fonts, and a CDP launcher script. The provided code instead performs an optional two-step network installation: piping a remote install script from browser-use.com into bash, and installing a browser-use skill from GitHub using npx. Its printed messages and final instruction to register an API key indicate a different primary purpose: setting up browser-use tooling, not provisioning the described browser environment. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

A setup-only skill should not normalize weakening browser sandbox or network restrictions beyond what is strictly required. Telling operators to work around policy failures rather than respect them expands the skill from initialization into security-control circumvention.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

sleep 2

Verify CDP is reachable

curl -s http://localhost:9223/json | python3 -m json.tool | head -20

Verify with a screenshot (see the CDP screenshot flow in REFERENCE.md)

text

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide explicitly instructs users to switch to direct CDP when the built-in browser reports 'blocked by policy,' which is effectively guidance for bypassing a security control. Even if intended for reliability, documenting a fallback around SSRF protections enables access patterns the platform deliberately tried to prevent.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

curl ... | bash is a direct remote-code-execution pattern: any content returned by the remote server is executed immediately. Because this skill is meant for one-time machine setup, successful exploitation could install persistent malware, alter test tooling, steal secrets, or compromise subsequent browser-based automation.

Content

Scanner excerpt · scripts/setup-optional.sh (reported line 6)May include surrounding context.

sh

# Failures here are non-fatal — main testing flow works without browser-use.

echo "=== [opt 1/2] Installing browser-use CLI ==="
curl -fsSL --retry 3 https://browser-use.com/cli/install.sh | bash || {
    echo "  ⚠ browser-use CLI install failed. Retry manually:"
    echo "    curl -fsSL https://browser-use.com/cli/install.sh | bash"
}

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script downloads shell code from browser-use.com and pipes it directly into bash, granting immediate code execution from a remote server at install time. In the context of a setup skill for fresh environments, this is especially dangerous because users may run it with high trust and little review, making compromise of the remote endpoint or network path highly impactful.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Even though this occurrence is in an error message, it instructs users to manually execute the same unsafe remote-script-to-shell command. Troubleshooting guidance that promotes insecure execution patterns can propagate the vulnerability beyond the automated path and normalize dangerous operator behavior.

Content

Scanner excerpt · scripts/setup-optional.sh (reported line 8)May include surrounding context.

sh

echo "=== [opt 1/2] Installing browser-use CLI ==="
curl -fsSL --retry 3 https://browser-use.com/cli/install.sh | bash || {
    echo "  ⚠ browser-use CLI install failed. Retry manually:"
    echo "    curl -fsSL https://browser-use.com/cli/install.sh | bash"
}

echo "=== [opt 2/2] Installing browser-use skill ==="

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill invokes shell commands (bash, cp, curl) but does not declare any tool scope or permission boundaries. That omission weakens governance and makes it harder for a calling system or reviewer to understand that the skill can execute code and modify the local environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrase setup browser is broad enough to match common user requests, increasing the chance this skill runs in contexts where one-time environment initialization was not intended. Because the skill executes shell commands and changes local configuration, accidental invocation can have real side effects.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users to modify an SSRF allowlist and, if policy enforcement still blocks navigation, to abandon the built-in browser and switch to direct CDP. That is effectively guidance for bypassing browser/network access controls, which can expose internal services or otherwise defeat intended security boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Reusing the user's local Chrome profile can expose cookies, active sessions, saved credentials, and other sensitive browsing artifacts to automation. Without an explicit warning, consent boundary, and data-handling restrictions, this creates avoidable privacy and account-takeover risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Recommending internal network tunneling without clear guardrails can expose private services or enable access to internal-only resources from automation tooling. In this context, the skill already discusses policy-block bypasses, which makes tunnel guidance more dangerous because it expands reachable attack surface.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file is scoped as a one-time browser setup skill, but it includes extensive operational guidance for browser automation, login flows, credential entry, policy-block handling, and runtime workarounds. That mismatch materially increases risk because operators may use the skill to access authenticated services or bypass platform safeguards under the guise of setup.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · TOOLS.md (reported line 122)May include surrounding context.

md

}

(async () => {
  const targets = await (await fetch('http://localhost:9223/json')).json();
  const ws = new WebSocket(targets[0].webSocketDebuggerUrl);
  await new Promise(r => ws.on('open', r));

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The CDP login example automates entry of email and password values directly into a script without any warning about secrets handling, storage, or logging. This normalizes embedding credentials in code and can lead to accidental disclosure through shell history, files, logs, or workspace artifacts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This optional setup installs an additional third-party CLI and skill that are not necessary for the stated purpose of local Chromium/CDP environment initialization. Expanding the trust boundary in a bootstrap script increases attack surface and may cause users to execute extra code they would not reasonably expect from the skill description.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The script invokes npx skills add without pinning the package version or otherwise constraining what code is executed. That means future upstream changes or a compromised dependency path could alter installation behavior unexpectedly, which is risky in a setup script that users are expected to run on fresh machines.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The fallback instruction repeats an unpinned npx skills add command, encouraging users to manually run an unconstrained package resolver. This extends supply-chain risk from the script itself to operator copy-paste behavior during troubleshooting.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The script downloads and executes @playwright/mcp via npx without pinning a specific version. That makes the setup non-reproducible and exposes the environment to supply-chain risk if the package publishes a malicious update or if dependency resolution is compromised.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The generated launcher starts Chromium with --remote-debugging-port, --remote-allow-origins='*', --no-sandbox, and a fixed --user-data-dir=/tmp/chrome-cdp-profile. This creates a persistent debuggable browser profile with weakened isolation; if another local process or exposed network path can reach the CDP port, an attacker may fully control the browser session, inspect data, and execute actions in that context.

Content

Scanner excerpt · scripts/setup.sh (reported line 45)May include surrounding context.

sh

# ── [2/3] Chrome CDP launcher script ──────────────────────
echo "=== [2/3] Creating chrome-cdp launcher ==="
mkdir -p "$HOME/.local/bin"
cat > "$HOME/.local/bin/chrome-cdp" << WRAPPER
#!/bin/bash
exec "$CHROME_BIN" \\

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Beyond installing Chromium and fonts, the script globally installs the ws Node package and registers a Playwright MCP server. These actions expand the agent's execution surface and persistence beyond simple browser setup, which is risky because they introduce additional remotely updateable code and alter future agent behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script changes the agent/browser runtime by registering Playwright MCP and then instructs the operator to edit openclaw configuration, including browser sandbox and SSRF policy settings. In context, that is more dangerous than ordinary setup because it can weaken runtime isolation and network protections for subsequent browser sessions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.