Testagent Browser Testing

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:28 AM UTC
• Version: 1.0.6

Overview

This browser-testing skill is mostly aligned with QA work, but it asks agents to make persistent browser security changes and use high-privilege browsing paths without enough scoping or warnings.

Install only if you are comfortable with an agent that can log into test sites, alter OpenClaw browser security settings, run an external setup script, and possibly use local browser sessions, tunnels, cloud browsers, proxies, or anti-bot/CAPTCHA tooling. Use dedicated least-privilege test accounts, avoid personal browser profiles, approve any allowlist or noSandbox change explicitly, and restore browser configuration after testing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: REFERENCE.md:189

Finding

Persistent Weakening of Browser Sandbox and SSRF Controls

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Execution of an Unpinned and Unaudited External Setup Script

Content

View full analysis

Remediation

View remediation

other

Note

• Location: REFERENCE.md:90

Finding

Static Scanner Alerts for curl Piping and Base64 Decoding Are Non-Exploitable in Context

Content

View full analysis

ws.send(JSON.stringify({id:1,method:'Page.captureScreenshot',params:{format:'png'}}))); ws.on('message', d => { const r = JSON.parse(d.toString()); if (r.id === 1) { require('fs').writeFileSync('$SCREENSHOT', Buffer.from(r.result.data,'base64')); ws.close(); process.exit(0); } }); " ``` ### Technical Analysis The flagged `curl` pipeline does not pipe remote content into `bash` or another shell. It retrieves JSON from a locally running Chrome DevTools endpoint and passes it to Python's JSON parser to select a page target identifier. The base64 operation decodes the `Page.captureScreenshot` response and writes the resulting bytes to a PNG file. The decoded data is not evaluated, imported, loaded as executable code, or passed to a command interpreter. The commands still rely on the local CDP endpoint being trustworthy, but the specific scanner claims of remote shell-payload execution and decode-then-execute behavior are not supported by the audited content. ### Attack Path No direct payload-execution path exists through the flagged operations as written: 1. The first command reads local CDP JSON and extracts a target ID. 2. The second command requests screenshot data from that target. 3. The base64 bytes are written to a `.png` file. 4. No decoded content is executed. ### Impact Assessment These two patt ...[truncated 442 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · REFERENCE.md (reported line 90)May include surrounding context.

md

sleep 2  # wait for it to start

# 2. Navigate to the target page
curl -s http://localhost:9223/json/new?about:blank  # create a new tab

TARGET_ID=$(curl -s "http://localhost:9223/json" | python3 -c \
  "import json,sys; t=[x for x in json.load(sys.stdin) if x.get('type')=='page']; print(t[0]['id'])")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file advises disabling the browser sandbox by setting noSandbox=true. Running a browser without its sandbox significantly reduces isolation against malicious web content, making compromise of the host/container more likely during routine testing of untrusted sites.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions tell the agent to modify SSRF protection allowlists to permit arbitrary target and SSO domains. Weakening SSRF controls expands the set of hosts the browser can reach and creates a path to access unintended internal or sensitive endpoints under the guise of testing.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly asks the user for a test account and password without any warning, minimization guidance, or secure-handling constraints. This creates a high risk of unnecessary credential exposure to the agent and downstream tools, especially given the skill also performs browser automation and external navigation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill recommends anti-bot, CAPTCHA, residential proxy, and cloud-browser features as ordinary fallback options. Those are bypass-oriented capabilities that can facilitate testing against services in ways that evade site protections and obscure origin, which exceeds normal functional testing and increases abuse potential.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The reference explicitly recommends reusing the user's local Chrome profile and using tunnel capabilities, which can expose authenticated sessions, cookies, and access to internal resources far beyond ordinary browser QA. In a testing skill, these capabilities materially expand privilege and data reach, so using them without strict consent and scope controls is dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Guidance to reuse the user's local Chrome login session lacks any warning that the agent may gain access to authenticated websites, stored cookies, and personal or corporate data. In this skill context, that omission can cause over-collection or misuse of sensitive session data during seemingly routine testing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The tunnel guidance omits any warning that exposing internal services can broaden network attack surface and route traffic to systems not intended for external access. In a browser-testing skill, presenting tunneling as a normal option makes misuse or accidental exposure more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger phrases include generic requests like "test this" and "help me test," which are broad enough to activate during ordinary conversation. Over-broad activation is dangerous in this context because the skill can collect credentials, navigate externally, and perform environment changes, so accidental invocation can lead to unintended sensitive actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to modify a local SSRF allowlist in ~/.openclaw/openclaw.json and restart browser/gateway services. That expands the skill from web testing into changing host security boundaries and platform state, which could be abused to authorize access to additional internal or sensitive domains under the guise of testing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill directs execution of a shell setup script for environment remediation, which grants system-setup capability beyond the declared testing function. Running local scripts from a testing skill increases the attack surface because the script could alter the host environment, install packages, or make persistent changes unrelated to the user's immediate request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The troubleshooting section includes specific handling for Chinese text rendering (:lang=zh) and names a Chinese font expectation, but does not frame this as optional or region-specific. This can be read as locale-specific guidance embedded in the skill without an explicit user opt-in or documented locale scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.