ClawHub
Back to skill

Security audit

AutoGLM Toolkit

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AutoGLM integration, but it gives an autonomous browser broad state-changing authority with optional sensitive-action auto-approval and limited safety scoping.

Review this skill before installing if you plan to use browser automation on logged-in sites. Keep auto_approve disabled unless you are deliberately accepting the risk, avoid using it for posting, purchases, account changes, or document edits without watching the session, and treat search terms, URLs, page contents, image prompts, and API credentials as data shared with the AutoGLM service.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill documents sending bearer tokens, app identifiers, timestamps, signatures, search queries, and target URLs to a remote AutoGLM service without any privacy or security warning. Users may unknowingly transmit sensitive credentials or browsing targets to a third-party endpoint, creating confidentiality, account, and data-handling risks.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The browser automation section explicitly enables impactful actions on third-party sites, including liking, commenting, reposting, logging in, and filling forms, but does not require an explicit user confirmation or warning before those actions occur. In the context of an autonomous agent, this increases the risk of unintended account actions, reputational harm, or policy-violating automation on behalf of the user.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| `task` | ✅ | Task description (use user's exact words) |
| `start_url` | Optional | Starting URL for the task |
| `session_id` | Optional | Resume previous browser session |
| `auto_approve` | Optional | Auto-approve sensitive operations (default: false) |

### Session Management
- Sessions persist in session pool with 12-hour TTL
Confidence
85% confidence
Finding
The same browser agent capability is presented as able to auto-approve sensitive operations, which constitutes autonomous decision-making over actions with external consequences. Given the session persistence and broad browsing capabilities, the lack of mandatory review makes mistakes or abuse materially more dangerous.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| `task` | ✅ | Task description (use user's exact words) |
| `start_url` | Optional | Starting URL for the task |
| `session_id` | Optional | Resume previous browser session |
| `auto_approve` | Optional | Auto-approve sensitive operations (default: false) |

### Session Management
- Sessions persist in session pool with 12-hour TTL
Confidence
85% confidence
Finding
The same browser agent capability is presented as able to auto-approve sensitive operations, which constitutes autonomous decision-making over actions with external consequences. Given the session persistence and broad browsing capabilities, the lack of mandatory review makes mistakes or abuse materially more dangerous.

Natural-Language Policy Violations

Low
Confidence
87% confidence
Finding
The deep research output template hardcodes Chinese section headings and title text, which effectively forces a specific language for outputs. The policy allows locale constraints only when users are given a choice or the constraint is clearly justified; this file presents the format as the default requirement without opt-in.

Static analysis

No suspicious patterns detected.