Bb Browser Sites

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:46 AM UTC
• Version: 0.1.0

Overview

This skill is coherent for website-to-CLI browsing, but it asks agents to download mutable community adapters and run them in an authenticated browser context without clear integrity or capability controls.

Review this before installing if you use OpenClaw's browser while logged in to sensitive accounts. Prefer a separate browser profile or low-privilege accounts, avoid running unknown community adapters, and update adapters only from sources you trust.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unverified Community Adapter Supply Chain

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-25
Vulnerability Type: Unverified retrieval and subsequent use of mutable community adapters
Risk Level: Medium

Vulnerable Code Snippet:

bash

# First time: pull community adapters
bb-browser site update

# See what's available
bb-browser site list

# See which adapters match your browsing habits
bb-browser site recommend

The downloaded adapters are subsequently invoked through the OpenClaw browser:

bash

# Run any adapter via OpenClaw's browser
bb-browser site reddit/hot --openclaw
bb-browser site hackernews/top 5 --openclaw
bb-browser site v2ex/hot --openclaw

Technical Analysis

The Skill directs users to retrieve mutable “community adapters” by running bb-browser site update. It does not specify an immutable version, trusted repository, cryptographic hash, digital signature, review procedure, or other integrity-verification mechanism.

These externally sourced adapters are subsequently used through OpenClaw's browser. The Skill also states that adapters operate using the browser's existing login state. This creates a supply-chain trust boundary: behavior that was not included in the audited Skill package may be downloaded later and used in a browser context containing authenticated sessions.

The reviewed file does not establish that the adapter source is malicious or that adapters can execute arbitrary operating-system code. The risk is therefore limited to the unsafe and undocumented dependency-update model demonstrated by the instructions.

Attack Path

1. An attacker compromises the community adapter distribution source or publishes a malicious adapter through its accepted contribution process.
2. A user follows the Skill instructions and executes bb-browser site update.
3. The altered adapter is retrieved without any documented signature, hash, version pin, or manual change review.
4. The user i ...[truncated 1037 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every adapter to an immutable, reviewed version or commit identifier rather than implicitly retrieving the latest release.
2. Publish and enforce an allowlisted official adapter registry with clearly documented ownership and review controls.
3. Require cryptographic signature and checksum verification before installing or updating adapters.
4. Display adapter source changes and requested capabilities before an update is accepted.
5. Sandbox adapters and deny local process execution, unrestricted filesystem access, and arbitrary network destinations unless explicitly required.
6. Restrict each adapter to approved website origins and the minimum browser APIs needed for its declared function.
7. Require explicit user approval before an adapter can operate in an authenticated browser session.
8. Separate sensitive login sessions from adapter-driven browsing by using isolated browser profiles or containers.
9. Provide rollback support and maintain an auditable record of installed adapter versions, sources, signatures, and updates.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages running website adapters through OpenClaw's browser and explicitly relies on the user's existing login state, but the top-level description does not clearly warn that commands may access authenticated data from active browser sessions. This can mislead users into treating the commands as ordinary public-web scraping when they may instead expose private account data, personalized feeds, or other session-bound information from many supported platforms.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.