ClawHub
Back to skill

Security audit

bb-browser

Security checks for vulnerabilities and agentic risk

Overview

This skill is review-worthy because it pulls community website adapters and runs them through your logged-in OpenClaw browser without documenting trusted sources, pinning, or permission limits.

Install only if you trust bb-browser's adapter source and are comfortable with adapters seeing data available in your logged-in browser sessions. Prefer a separate browser profile for sensitive accounts, review each adapter before use, and avoid running community updates blindly on accounts that can post, trade, administer, or expose private data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unverified Community Adapters Execute in an Authenticated Browser Context

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-18, 29-35, and 104-111
Vulnerability Type: Unverified third-party adapter supply chain
Risk Level: Medium
Category: T08: Insecure Dependencies

Vulnerable Code Snippet

markdown
## Quick Start

```bash
# First time: pull community adapters
bb-browser site update

IMPORTANT: Always use --openclaw

Every bb-browser site command MUST include --openclaw to use OpenClaw's browser:

bash
# Correct
bb-browser site twitter/search "AI agent" --openclaw
bb-browser site zhihu/hot 10 --openclaw --json
bb-browser site xueqiu/hot-stock 5 --openclaw --jq '.items[] | {name, changePercent}'

Login State

Adapters run inside OpenClaw's browser tabs. If a site requires login:

  1. The adapter will return an error like {"error": "HTTP 401", "hint": "Not logged in?"}
  2. Log in to the site in OpenClaw's browser:
    bash
    openclaw browser open https://twitter.com
  3. Complete login manually in the browser window
  4. Retry the command
text

### Technical Analysis

The Skill directs users to retrieve unspecified community adapters with `bb-browser site update` and subsequently run those adapters through OpenClaw's browser. The documented workflow deliberately uses the browser's existing authenticated state.

No authoritative adapter repository, reviewed version pin, cryptographic checksum, signed manifest, update approval process, or per-adapter permission boundary is documented. Consequently, the effective adapter implementation may change after the Skill itself has been reviewed. If the adapter source or distribution channel is compromised, an untrusted update could be delivered to users and then invoked in a browser context containing active website sessions.

The audit did not find evidence that the current adapters are malicious. The confirmed issue is the unsafe trust model and missing supply-chain co
...[truncated 1602 chars]
Remediation
View remediation

Remediation Suggestions

  1. Document the authoritative adapter registry and require all adapters to originate from an explicitly trusted source.
  2. Pin adapters to reviewed, immutable versions rather than automatically consuming the latest community release.
  3. Verify updates using cryptographically signed manifests and hashes anchored to trusted publisher identities.
  4. Display the source, version, hash, requested domains, and permission changes before installation or update, and require explicit user approval.
  5. Isolate each adapter in a sandbox with a deny-by-default policy for filesystem, process, network, and browser access.
  6. Restrict each adapter to an allowlist of required website origins and browser capabilities.
  7. Prevent adapters from accessing unrelated tabs, cookies, storage, or sessions unless those permissions are necessary and explicitly approved.
  8. Run third-party adapters in a dedicated browser profile without unrelated authenticated sessions or sensitive browsing data.
  9. Maintain a review and revocation process for compromised adapters and publisher keys.
  10. Record adapter installation, update, origin access, and privileged browser operations in auditable logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly promotes extracting structured data from websites 'using your login state' but does not present a clear upfront warning about the privacy and authorization implications. This can mislead users into running commands that access account-scoped content, personalized feeds, or other sensitive data through their authenticated browser session without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.