ClawHub
Back to skill

Security audit

browser-recover

Security checks for vulnerabilities and agentic risk

Overview

This browser recovery skill is purpose-aligned but needs review because its recovery script can automatically kill broad browser or port-owning processes and delete browser state without proving they belong to the intended OpenClaw instance.

Install only if you are comfortable with a recovery script that can close browser processes, terminate services using selected local ports, and delete OpenClaw browser lock/cache state. Prefer running check_state.sh first, avoid default full recovery on shared machines, do not run it as root or in a privileged container, and verify the target browser profile and port belong to the current OpenClaw instance before running recover.sh.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/recover.sh:67
Finding

Broad Process Matching Can Terminate Unrelated or Personal Browsers

Content
View full analysis
/dev/null; then KILLED_COUNT=$((KILLED_COUNT + 1)) echo " Killed processes matching: $proc" >&2 fi done ``` ### Technical Analysis The script uses `pkill -f` with generic browser names. The `-f` option matches against the entire process command line, so any process containing strings such as `chrome` or `chromium` can be terminated. The implementation does not perform the safeguards required by the project's own documentation: - It does not verify that the process is owned by the current user. - It does not check for an OpenClaw-specific `--user-data-dir`. - It does not confirm that the process uses an OpenClaw debugging port. - It does not associate the process with the current Agent or workspace. - It does not inspect or log individual PIDs before termination. This directly contradicts `SKILL.md:93-102` and `references/safety.md:11-28`, which require ownership and profile verification and explicitly prohibit broadly killing personal browser processes. The problem is amplified because running `recover.sh` without arguments enables full recovery by default, including this destructive operation. ### Attack Path 1. A user has a personal Chrome or Chromium session running, or another Agent runs a browser on the same host. 2. An OpenClaw browser operation fails for any reason. 3. The Agent follows the documented workflow and invokes `scripts/recover.sh`. 4. The script executes `pkill -f` against generic browser names. 5. The personal or unrelated browser process matches one of those strings and is terminated without verification or confirmation. An atta ...[truncated 914 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/recover.sh:89
Finding

Port Cleanup Terminates Arbitrary Services Without Ownership Validation

Content
View full analysis
/dev/null; then if fuser -k "${port}/tcp" 2>/dev/null; then CLEARED_COUNT=$((CLEARED_COUNT + 1)) echo " Cleared port: $port" >&2 fi elif command -v lsof &> /dev/null; then PID=$(lsof -ti:"$port" 2>/dev/null || true) if [[ -n "$PID" ]]; then kill -9 "$PID" 2>/dev/null || true CLEARED_COUNT=$((CLEARED_COUNT + 1)) echo " Cleared port: $port (PID: $PID)" >&2 fi fi done ``` ### Technical Analysis The script assumes that any process using ports 9222, 18800, or the configured debug port is a stale OpenClaw browser. It then uses either `fuser -k` or `kill -9` to terminate the port owner. Port numbers do not establish process identity or ownership. Another OpenClaw instance, a personal browser, a development server, or an unrelated application can legitimately use one of these ports. The script does not inspect the executable, command line, user, profile directory, or workspace before killing the process. The `lsof` fallback is especially destructive because it immediately sends `SIGKILL`. It neither attempts graceful termination nor revalidates that the PID still represents the same process, creating an additional PID reuse and race-condition concern. This behavior contradicts `references/safety.md`, which requires inspection of a port owner before deciding whether termination is safe. ### Attack Path 1. An unrelated service or browser listens on TCP port 9222, 18800, or a port configured as `browser.debugPort`. 2. An OpenClaw browser operation fails and triggers recovery. 3. The Agent runs `recover.sh --clear-ports` or invokes the no-argument full recovery mode. 4. `fuser -k` terminate ...[truncated 1095 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/recover.sh:115
Finding

Lock Files and Caches Are Deleted Without Verifying Profile Activity

Content
View full analysis
/dev/null || true) if [[ -n "$LOCK_FILES" ]]; then echo "$LOCK_FILES" | while read -r lock_file; do rm -f "$lock_file" echo " Removed: $lock_file" >&2 done else echo " No lock files found" >&2 fi # Clear cache directories (optional, only if they're causing issues) CACHE_DIRS=("Cache" "Code Cache" "GPUCache") ``` The cache deletion continues immediately afterward: ```bash for cache_dir in "${CACHE_DIRS[@]}"; do if [[ -d "$DEFAULT_PROFILE_PATH/$cache_dir" ]]; then rm -rf "${DEFAULT_PROFILE_PATH:?}/$cache_dir" 2>/dev/null || true echo " Cleared: $cache_dir" >&2 fi done ``` ### Technical Analysis The script recursively discovers every `Singleton*` entry beneath the default OpenClaw browser directory and removes it without checking whether an active browser process currently owns the profile or lock. It also removes shared cache directories without first establishing that the profile is inactive. Browser lock files exist to prevent concurrent processes from using the same profile. Removing them while another instance is running can allow a second browser to open the same profile concurrently, undermining profile isolation and risking state corruption. The script also hard-codes `DEFAULT_PROFILE_PATH="$HOME/.openclaw/browser"` even though `references/configuration.md` states that `browser.userDataDir` is used. Consequently, the documented custom-profile isolation behavior is not implemented. ### Attack Path 1. Another OpenClaw Agent or browser instance actively uses a profile beneath `~/.openclaw/browser`. 2. A separate browser operation fail ...[truncated 1052 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill documentation advertises targeted browser recovery, but it also declares cache deletion (Cache, Code Cache, GPUCache), which is a destructive action not reflected in the high-level description. Undeclared destructive behavior can cause data loss, session breakage, or unexpected side effects, especially if users or higher-level agents invoke the skill assuming it only frees processes, ports, and locks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill documentation advertises targeted browser recovery, but it also declares cache deletion (Cache, Code Cache, GPUCache), which is a destructive action not reflected in the high-level description. Undeclared destructive behavior can cause data loss, session breakage, or unexpected side effects, especially if users or higher-level agents invoke the skill assuming it only frees processes, ports, and locks.

Content

No source excerpt is available for this finding.

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The documentation advises that Docker environments may need the --privileged flag for process management. Recommending privileged containers is dangerous because it substantially weakens container isolation and can enable host-level impact if combined with a compromised recovery script or other container escape conditions.

Content

Scanner excerpt · references/configuration.md (reported line 116)May include surrounding context.

md
- Lock files in `~/Library/Application Support/...`

### Docker/Container Environments
- May need `--privileged` flag for process management
- Shared PID namespace considerations
- Volume mounts for profile directories

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/safety.md (reported line 22)May include surrounding context.

❌ Never Delete User Profile Directories

bash
# WRONG: This deletes user's personal browsing data
rm -rf ~/.config/google-chrome
rm -rf ~/.config/chromium

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/safety.md (reported line 23)May include surrounding context.

❌ Never Delete User Profile Directories

bash
# WRONG: This deletes user's personal browsing data
rm -rf ~/.config/google-chrome
rm -rf ~/.config/chromium

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/safety.md (reported line 22)May include surrounding context.

❌ Never Delete User Profile Directories

bash
# WRONG: This deletes user's personal browsing data
rm -rf ~/.config/google-chrome
rm -rf ~/.config/chromium

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/safety.md (reported line 23)May include surrounding context.

bash
# WRONG: This deletes user's personal browsing data
rm -rf ~/.config/google-chrome
rm -rf ~/.config/chromium

❌ Never Use kill -9 Without Verification

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

rm -f ~/.openclaw/browser/*/SingletonLock is intended to remove stale lock files, but the wildcard path can affect multiple profiles and lacks explicit validation of ownership, active use, or symlink safety. In a multi-instance environment, deleting lock files for live sessions can corrupt state or interfere with unrelated agent/browser processes.

Content

Scanner excerpt · references/safety.md (reported line 44)May include surrounding context.

✅ Clean Only OpenClaw Profile Directories

bash
# CORRECT: Only cleans OpenClaw-managed profiles
rm -f ~/.openclaw/browser/*/SingletonLock
rm -rf ~/.openclaw/browser/*/Cache

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

This duplicate finding highlights the same recursive cache deletion command. Even though cache cleanup is lower risk than profile deletion, the broad globbed rm -rf can still cause denial of service or unintended deletion if directory boundaries are not strictly enforced.

Content

Scanner excerpt · references/safety.md (reported line 45)May include surrounding context.

bash
# CORRECT: Only cleans OpenClaw-managed profiles
rm -f ~/.openclaw/browser/*/SingletonLock
rm -rf ~/.openclaw/browser/*/Cache

✅ Verify Port Ownership Before Clearing

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

This duplicate finding highlights the same recursive cache deletion command. Even though cache cleanup is lower risk than profile deletion, the broad globbed rm -rf can still cause denial of service or unintended deletion if directory boundaries are not strictly enforced.

Content

Scanner excerpt · references/safety.md (reported line 45)May include surrounding context.

bash
# CORRECT: Only cleans OpenClaw-managed profiles
rm -f ~/.openclaw/browser/*/SingletonLock
rm -rf ~/.openclaw/browser/*/Cache

✅ Verify Port Ownership Before Clearing

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/recover.sh (reported line 130)May include surrounding context.

sh
CACHE_DIRS=("Cache" "Code Cache" "GPUCache")
        for cache_dir in "${CACHE_DIRS[@]}"; do
            if [[ -d "$DEFAULT_PROFILE_PATH/$cache_dir" ]]; then
                rm -rf "${DEFAULT_PROFILE_PATH:?}/$cache_dir" 2>/dev/null || true
                echo "  Cleared: $cache_dir" >&2
            fi
        done

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
**DON'T:**
- Kill user's personal browser processes
- Delete user profile directories (`~/.config/chrome`, etc.)
- Use `kill -9` without verification
- Restart entire system
- Clean up other agents' browser instances without isolation

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation states that the recovery process cleans the browser profile directory but does not clearly warn that this can reset sessions, delete local browser state, or affect user data if the configured profile points to a real browser profile. In a recovery skill that automatically performs cleanup, this omission increases the chance of destructive use through misconfiguration or operator misunderstanding.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · references/configuration.md (reported line 125)May include surrounding context.

Config File Not Found

bash
# Check if config exists
ls -la ~/.openclaw/config/openclaw.json

# If missing, scripts will use defaults

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · references/troubleshooting.md (reported line 219)May include surrounding context.

Config File Not Found

bash
# Check if config exists
ls -la ~/.openclaw/config/openclaw.json

# If missing, scripts will use defaults

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/configuration.md (reported line 141)May include surrounding context.

Permission Issues

bash
# Ensure config is readable
chmod 644 ~/.openclaw/config/openclaw.json

# Ensure profile directory is writable
chmod 755 ~/.openclaw/browser

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/configuration.md (reported line 144)May include surrounding context.

chmod 644 ~/.openclaw/config/openclaw.json

Ensure profile directory is writable

chmod 755 ~/.openclaw/browser

text

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/safety.md (reported line 26)May include surrounding context.

rm -rf ~/.config/chromium

text

### ❌ Never Use kill -9 Without Verification
```bash
# WRONG: Forcefully kills without checking ownership
kill -9 $(pidof chrome)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/safety.md (reported line 28)May include surrounding context.

❌ Never Use kill -9 Without Verification

bash
# WRONG: Forcefully kills without checking ownership
kill -9 $(pidof chrome)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting.md (reported line 86)May include surrounding context.

  1. Install missing tools:
    bash
    # Debian/Ubuntu
sudo apt-get install psmisc lsof procps

# RHEL/CentOS
sudo yum install psmisc lsof procps-ng

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting.md (reported line 89)May include surrounding context.

md
sudo apt-get install psmisc lsof procps
   
   # RHEL/CentOS
   sudo yum install psmisc lsof procps-ng
   
   # macOS
   # lsof is built-in, fuser not available (script handles this)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The troubleshooting guide recommends deleting and recreating the browser profile directory as a recovery step, but it does not clearly warn that profile data may contain cookies, session state, saved preferences, downloads metadata, and other user data that could be permanently lost. In a recovery skill that already manipulates browser state, this omission increases the chance an operator will perform destructive cleanup without informed consent or backup.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
references/safety.md:45