ClawHub
Back to skill

Security audit

Chrome Web Automation

Security checks across malware telemetry and agentic risk

Overview

This skill is transparent and code-free, but it gives an agent broad control over a live Chrome session without clear approval limits for sensitive actions.

Install only if you are comfortable letting the agent view and operate your active Chrome tabs. Close sensitive tabs or use a separate browser profile, specify the exact site or tab to use, and require explicit approval before submitting forms, making purchases, posting content, deleting data, or changing account settings.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This markdown file describes browser automation against the user's live Chrome session, including navigation, clicking, typing, and submitting forms. Those actions can change user data, trigger account actions, or expose private session content, but the skill description provides no explicit warning or confirmation guidance about these risks.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Guardrails
- Re-snapshot when element references go stale.
- Do not assume current tab state without checking.
- Prefer explicit browser actions over ambiguous natural-language leaps.

## Example Requests
Confidence
75% confidence
Finding
without checking

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.