Browser Research Lite

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:37 PM UTC
• Version: 1.0.0

Overview

This skill is mostly a browser-research helper, but it silently reads recent local OpenClaw session logs before doing browser checks.

Review before installing. The skill does not appear malicious and I found no persistence, destructive behavior, credential theft, or network exfiltration, but it does read recent local OpenClaw session logs as part of a browser availability check. Install only if you are comfortable with that local diagnostic access, or prefer a version that checks browser status without reading historical session files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/browser_guard.py:28

Finding

Unnecessary Access to Sensitive Agent Session Logs

Content

View full analysis

Vulnerability Details

File Location: scripts/browser_guard.py, lines 28-43
Vulnerability Type: Least-privilege violation through unnecessary access to agent session logs
Risk Level: Medium

Vulnerable Code

python

p.add_argument("--sessions-dir", default=os.path.expanduser("~/.openclaw/agents/main/sessions"))
p.add_argument("--file-limit", type=int, default=12)
p.add_argument("--unavailable-threshold", type=int, default=2)
args = p.parse_args()

pattern = os.path.join(args.sessions_dir, "hle_eval_*.jsonl")
files = recent_files(pattern, args.file_limit)
browser_calls = 0
unavailable_hits = 0

for fp in files:
    tail = read_tail(fp)
    if not tail:
        continue
    browser_calls += tail.count('"toolName":"browser"') + tail.count('"name":"browser"')
    unavailable_hits += tail.lower().count("no connected browser-capable nodes")

The associated file-reading implementation appears at scripts/browser_guard.py, lines 16-24:

python

def read_tail(path: str, max_bytes: int = 20000) -> str:
    try:
        size = os.path.getsize(path)
        start = max(0, size - max_bytes)
        with open(path, "rb") as f:
            f.seek(start)
            return f.read().decode("utf-8", errors="ignore")
    except Exception:
        return ""

Technical Analysis

The browser availability guard enumerates up to 12 recent JSONL files under the default directory ~/.openclaw/agents/main/sessions and reads as much as 20 KB from the end of each file. Agent session logs may contain prompts, responses, tool activity, and other sensitive conversation context.

This access is not required to determine current browser availability. The same script already executes openclaw browser status --json at lines 49-55 and uses its running and cdpReady fields. Reading historical session content therefore expands the Skill's access beyond its stated browser-status function and violates the principle of least privilege.

The current implementat ...[truncated 1914 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove session-log enumeration and the read_tail() operation from the browser availability workflow.

2. Determine availability solely from the structured result of:

   python

   subprocess.run(
       ["openclaw", "browser", "status", "--json"],
       check=False,
       capture_output=True,
       text=True,
       timeout=15,
   )
   

3. Remove the --sessions-dir, --file-limit, and --unavailable-threshold options if they are no longer required.

4. If historical failure tracking is essential, require explicit user opt-in and use a dedicated status or telemetry file that contains no prompts, responses, or tool arguments.

5. Minimize retained information to non-sensitive counters and timestamps, and document every local data source the Skill accesses.

6. Add automated tests confirming that an availability check does not open files in agent session directories.

7. Consider applying process-level sandboxing or filesystem allowlisting so the guard can access only the browser-status executable and other resources strictly required for its task.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the skill inspects ~/.openclaw session/log data and runs openclaw browser status --json, it goes beyond browser research into local environment reconnaissance. That broadens risk to privacy and sensitive metadata exposure, especially because the declared purpose does not warn about host-level inspection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the skill inspects ~/.openclaw session/log data and runs openclaw browser status --json, it goes beyond browser research into local environment reconnaissance. That broadens risk to privacy and sensitive metadata exposure, especially because the declared purpose does not warn about host-level inspection.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the skill inspects ~/.openclaw session/log data and runs openclaw browser status --json, it goes beyond browser research into local environment reconnaissance. That broadens risk to privacy and sensitive metadata exposure, especially because the declared purpose does not warn about host-level inspection.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · index.js (reported line 55)May include surrounding context.

js

}

  // 2. Since this is a "lite" skill, we don't implement full automation here yet.
  // We return instructions or status.
  return {
    status: 'ready',
    message: 'Browser is available. Proceed with browser tool calls manually or via agent instructions.'

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill instructs the agent to run a local Python script via shell, but the manifest declares no explicit tool scope or permissions. That creates an authorization gap where a seemingly simple research skill can invoke local execution and file access capabilities that users or reviewers may not expect.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

- If browsing is blocked/captcha-heavy, switch to alternative domains and shorter queries.
- If browser node is unavailable, avoid repeated browser calls in the same question.
- If browser remains unavailable, switch to `skills/web-fetch-research-lite/SKILL.md` and run URL-first retrieval via `web_fetch`.
- If no reliable source is found quickly, return best-effort answer and mark uncertainty.

## Solidify Note

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill for doing online research via the built-in browser tool when web_search is unavailable. However, the exported research function does not conduct any browsing, searching, or evidence gathering; it only verifies availability and returns either a fallback suggestion or a 'ready' status message.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script reads recent local session logs from ~/.openclaw/agents/main/sessions and aggregates browser-tool usage and error telemetry, which exposes cross-session metadata unrelated to performing browser-based research. In the context of a research skill, this broad local inspection is over-scoped and can leak activity patterns or operational state from other agent runs, increasing privacy and reconnaissance risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/browser_guard.py (reported line 50)May include surrounding context.

python

cli_cdp_ready = None
    cli_error = ""
    try:
        proc = subprocess.run(
            ["openclaw", "browser", "status", "--json"],
            check=False,
            capture_output=True,

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The manifest frames this as an API-key-free research skill using the built-in browser tool. Spawning a local Python process to probe environment/browser state is not an obvious part of conducting research itself and introduces an extra execution capability beyond straightforward browser use.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module-level documentation states that the file provides an interface to browser-based research, implying substantive research functionality. In practice, the code never performs browser research and only checks a Python guard script before returning status, which contradicts the documented intent.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:19