ClawHub
Back to skill

Security audit

Browsecraft

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent browser-automation helper, with the main caution that it relies on an unpinned globally installed npm CLI.

Install this only if you trust the browsecraft-cli npm package and the browser automation workflows you plan to run. Prefer a pinned version or isolated environment, avoid elevated installs, keep credentials in environment/config rather than command lines, and use a dedicated browser profile for sensitive sites or bulk actions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 13
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippets

yaml
metadata: {"openclaw":{"emoji":"🧭","requires":{"bins":["browsecraft"]},"install":[{"id":"npm","kind":"node","package":"browsecraft-cli","bins":["browsecraft"],"label":"Install BrowseCraft CLI (npm)"}]}}
markdown
1. Install CLI: `npm install -g browsecraft-cli`

Technical Analysis

The skill instructs users to install browsecraft-cli from the npm registry without specifying an exact reviewed version or validating package integrity. The -g option installs the package globally for the current npm environment and exposes its executable through the user's command search path.

Because no version is pinned, the installed code is whichever release npm resolves at installation time rather than a release that was examined during this audit. A malicious future release, compromised maintainer account, or compromised package distribution channel could therefore alter the effective behavior after review. npm may also execute package lifecycle scripts during installation, allowing package-supplied code to run immediately with the privileges of the user performing the installation.

No evidence in the audited file establishes that browsecraft-cli is currently malicious. The finding concerns the unsafe and mutable dependency acquisition process.

Attack Path

  1. An attacker compromises the npm package, its publisher account, or its release process and publishes a malicious version of browsecraft-cli.
  2. A user follows the skill's instruction to run npm install -g browsecraft-cli.
  3. npm resolves the attacker-controlled release because the instruction provides no exact version or integrity constraint.
  4. Malicious lifecycle code may execute during installation, or the globally installed browsecraft execut ...[truncated 837 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact reviewed version, for example:
    bash
    npm install --global --ignore-scripts browsecraft-cli@X.Y.Z
    Replace X.Y.Z with a verified release.
  2. Verify the package publisher, provenance, release signatures where available, and expected registry before installation.
  3. Record and validate the expected package integrity digest rather than trusting only the package name and version.
  4. Avoid global installation when feasible. Install the dependency in an isolated project or container with a committed lockfile and invoke the pinned local binary.
  5. Disable npm lifecycle scripts during installation when they are not required. If they are required, review those scripts and their transitive execution paths before permitting them.
  6. Audit and lock transitive dependencies using reproducible installation controls such as a lockfile and npm ci.
  7. Run browser automation with a dedicated, least-privileged account or sandbox, and provide only the credentials and filesystem access required for the requested workflow.
  8. Document the verified source repository, publisher identity, approved version, integrity value, and update-review procedure in SKILL.md.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep