ClawHub
Back to skill

Security audit

Bb Browser Sites

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate browser-to-CLI helper, but it can use logged-in browser sessions across many sites with broad command and adapter-update authority that users should review carefully.

Install only if you trust bb-browser and the adapter source it updates from. Use a separate or low-privilege browser profile where practical, avoid running it while logged into sensitive accounts unless that is intended, and review the specific site command before letting it access authenticated pages.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill repeatedly encourages extraction of website data using the user's existing browser login state, but it does not warn that commands may access personalized, private, or account-scoped content. In this context, missing privacy disclosure is security-relevant because users may run commands assuming they operate on public data, when they may actually expose private feeds, messages, billing/account metadata, or other authenticated content to the agent workflow.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal