ClawHub
Back to skill

Security audit

Browser Steel

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent browser-automation wrapper, but it exposes high-impact web automation, authenticated session reuse, and anti-bot bypass features with limited guardrails.

Install only if you need Steel-based browser automation and trust the runtime environment. Use a scoped Steel API key, keep cookie files site-specific, review plan files before running them, stop sessions after use, and avoid stealth, proxy, or CAPTCHA-solving features unless you are authorized to automate that site.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
return None

    command = [str(target)] + sys.argv
    return subprocess.call(command, env=env)


async def _run_python_plan_async(args, env):
Confidence
95% confidence
Finding
return subprocess.call(command, env=env)

Tainted flow: 'command' from os.environ.get (line 448, credential/environment) → subprocess.call (code execution)

Medium
Category
Data Flow
Content
return None

    command = [str(target)] + sys.argv
    return subprocess.call(command, env=env)


async def _run_python_plan_async(args, env):
Confidence
97% confidence
Finding
return subprocess.call(command, env=env)

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The generic browser passthrough exposes arbitrary steel browser subcommands and flags beyond the narrowly modeled workflows of scrape/screenshot/pdf/session operations. In an agent setting, this broadens the action surface and may allow unreviewed capabilities, unexpected network interactions, or access to local/browser features that the skill manifest does not clearly constrain.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documented login/form workflow explicitly instructs operators to fill fields and click through authenticated flows, but it provides no warning or constraints around handling credentials, session cookies, or other sensitive browser state. In a browser automation skill, this omission increases the chance that users or downstream agents will input secrets into commands, logs, snapshots, or persistent sessions without appropriate safeguards.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The documentation explicitly exposes `--use-proxy` and `--solve-captcha` capabilities without any guardrails, user-consent requirements, or policy warnings. In a browser automation skill, these features materially increase the likelihood of bypassing site controls, masking origin, or interacting with services in ways that may violate terms, privacy expectations, or compliance requirements.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.