Testagent Browser Testing

• Outcome: Review
• Latest audit: Jul 23, 2026 · 10:13 AM UTC
• Version: 1.0.6

Overview

This browser-testing skill is mostly coherent, but it gives agents broad access to browser sessions, network reach, and local OpenClaw configuration without enough user-facing scoping or consent.

Install only if you intend to delegate browser QA on systems you control or are authorized to test. Avoid using your personal Default Chrome profile; prefer test accounts and isolated browser profiles. Treat SSRF allowlist edits, internal tunnels, residential proxies, CAPTCHA bypass, sandbox changes, and gateway restarts as administrator-level actions that should be reviewed, scoped to specific approved domains, and rolled back after testing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The reference expands a functional web-testing skill into capabilities such as CAPTCHA bypass, residential proxies, cloud browsers, and internal tunneling, which materially increase the ability to evade protections and reach systems outside normal test scope. In this context, those instructions are not tightly constrained to approved testing targets and create misuse potential beyond ordinary QA automation.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Advising use of the user's local Chrome profile via `--profile "Default"` grants access to existing authenticated sessions, cookies, and potentially sensitive account data. That exceeds the stated browser-testing scope and could let the skill act as the user across unrelated sites without a clear consent boundary.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Documenting internal network tunneling and SSRF allowlist changes enables access to internal services and weakens built-in network protections. In a general testing skill, that broadens reachable attack surface and can facilitate probing or interaction with internal-only resources outside intended scope.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to modify the local SSRF allowlist in ~/.openclaw/openclaw.json and restart browser/gateway services to reach arbitrary target and login domains. That expands the agent from web testing into host-level configuration changes that weaken network access controls and can enable access to internal or otherwise blocked hosts if a malicious user supplies crafted targets.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill directs execution of an external shell script for troubleshooting, giving it subprocess-like system modification capability beyond ordinary browser testing. Running setup scripts from a skill increases the blast radius to the local machine and can be abused to change packages, fonts, configs, or other system state without strong necessity or review.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs reuse of the local Chrome login session without warning that this exposes authenticated browser state, cookies, and account context. Users may unknowingly permit access to private sessions, creating a consent and privacy failure even if the feature is used as intended.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guidance to use `--profile "Default"` omits a user-facing disclosure that it accesses the user's primary browser profile and live sessions. That makes a sensitive capability easy to invoke without informed consent or understanding of the privacy implications.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The tunnel capability is presented as a normal option without warning that it can route access to internal services and expand network exposure. Even when used for testing, users should be explicitly informed that this can bridge into non-public environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The troubleshooting section recommends adding domains to the SSRF allowlist without explaining that this weakens a security safeguard designed to restrict server-side navigation targets. Such guidance can normalize bypassing protections and increase the risk of unintended access to sensitive hosts.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger phrases are broad enough to match ordinary conversation, which can cause this powerful skill to activate unexpectedly. Because the skill includes sensitive actions like logging into sites, taking screenshots, changing local config, and filing issues, accidental invocation materially increases security and privacy risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.