ClawHub
Back to skill

Security audit

Clawbrowser Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it can scrape browser content, persist it locally, and upload it to Feishu with insufficient top-level scoping and consent.

Install only if you are comfortable running a broad browser automation and scraping tool. Use it in a sandboxed account or container, avoid private/internal/authenticated pages unless explicitly intended, disable or clear caches, and do not use the web_scraper CLI unless Feishu upload and local archival are acceptable for the target content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
browser_tool_py36.py:204
Finding

Unrestricted Local and Internal Resource Access with Optional External Upload

Content
View full analysis
1: url = sys.argv[2] result = scraper.scrape(url, save_to_feishu=True) ``` ### Technical Analysis The `open()` method accepts arbitrary destinations without validating the resolved IP address, hostname, port, redirect destination, or trust boundary. It expressly pe ...[truncated 2127 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
browser_tool_py36.py:41
Finding

Sensitive Browser Snapshots Persisted in Plaintext Without Effective Disk Expiration

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:33
Finding

Unpinned npm and npx Dependencies Can Execute Unreviewed Future Package Code

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented purpose centers on headless browser automation, ARIA ref interaction, and natural-language control, but the detected behavior reportedly extends to content scraping, local file output, Feishu document creation, and batch/scheduled collection. This mismatch is dangerous because users and policy engines may approve the skill under a narrower trust model than its real data-exfiltration and persistence capabilities justify.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to run npx clawhub without pinning an exact package version. Because npx resolves and executes the latest published package by default, a compromised or malicious future release could execute arbitrary code on the user's system during publishing workflows. In a skill-distribution context, this is more dangerous because readers are explicitly encouraged to run the command locally as part of installation and release operations.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README again references npx clawhub without an explicit version for the inspection step. This exposes users to the same supply-chain risk: npx may fetch and execute whatever package version is current at execution time, allowing arbitrary code execution if the package or dependency chain is compromised. The context increases risk because this is presented as a normal verification step, which may cause users to trust and run it without scrutiny.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises executable capabilities via required binaries and documented automation flows, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, this increases the chance that shell, filesystem, or environment access is used more broadly than the user expects, making abuse or accidental overreach harder to constrain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill promotes browser automation and web scraping without warning that it may collect personal, copyrighted, session-bound, or otherwise sensitive content and may perform state-changing actions on websites. In an agent context, absence of risk guidance makes misuse and accidental privacy or compliance violations more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

Free-form natural-language browser commands can be ambiguous and may cause unintended clicks, form submissions, navigation, or data entry on live sites. Without warnings or safeguards, an agent may execute destructive or privacy-impacting actions based on imprecise prompts or manipulated page content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The tool stores browser results on disk under ~/.openclaw/cache/browser without user-facing disclosure, and cache_get/cache_set can persist page data, snapshots, and command outputs across runs. In a browser automation context this may silently retain sensitive URLs, page content, or extracted data on shared systems, increasing privacy and data-exposure risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · browser_tool_py36.py (reported line 168)May include surrounding context.

python
full_cmd = base_cmd + cmd
        
        try:
            result = subprocess.run(
                full_cmd,
                stdout=subprocess.PIPE,
                stderr=subprocess.PIPE,

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · browser_tool_py36.py (reported line 309)May include surrounding context.

python
else:
            return {"success": False, "error": "Traditional engine not implemented yet"}
    
    def wait(self, selector=None, timeout=None, text=None, load_state=None):
        """等待"""
        self._log("wait: selector=%s, timeout=%s, text=%s, load_state=%s" % (
            selector, timeout, text, load_state))

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill exposes JavaScript evaluation capability through the browser backend via _run_agent_browser(["eval", js_code]), enabling arbitrary script execution in the context of whatever page is loaded. In an agent skill, this expands capability beyond ordinary navigation/extraction and can be abused to access DOM-visible sensitive data, manipulate page state, or automate actions not obvious from the advertised interface.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes a general-purpose browser automation CLI with ARIA-based targeting, natural-language operation, and OpenClaw integration. In contrast, this module is a purpose-built scraper for articles/news/blogs that extracts page content and automatically saves results to local files and optionally to Feishu documents, which is a materially different, narrower-but-additional workflow than generic browser automation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The code performs persistent local storage and remote Feishu document creation that are not clearly disclosed by the stated skill purpose. Hidden or under-disclosed data egress and retention are dangerous because users may supply sensitive URLs or content without realizing the tool will archive and transmit scraped data to an external service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Automatic Feishu document creation expands the trust boundary from local browser automation to third-party content export. This is risky because scraped pages may contain confidential, copyrighted, or internal information that is silently replicated into an external collaboration platform.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The scraper preserves full page content and can forward it into Feishu without any filtering, redaction, or sensitivity checks. This is dangerous because secrets, personal data, internal-only material, or session-visible content may be copied wholesale into a persistent external document.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The tool stores full scraped content locally by default and batch mode also writes a summary containing all results, creating unnecessary retention of potentially sensitive natural-language data. Persistent archives increase exposure through local compromise, accidental sharing, backups, or later misuse beyond the original scraping purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The CLI paths call scrape and batch_scrape with save_to_feishu=True by default, which means page content is uploaded externally without an explicit warning or consent step. In a scraping tool, this can easily cause unintended disclosure of sensitive or regulated data gathered from private pages, intranets, or authenticated sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The screenshot method accepts a caller-supplied path and invokes the browser tool to save output there, which is a file-write operation. Although the method logs internally, there is no visible user disclosure or warning in the docstring/CLI text that invoking screenshots may create files on disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language interface recognizes only hard-coded Chinese and English command prefixes such as 打開/open, 點擊/click, and 填寫/fill. This imposes a language constraint in the user-facing behavior without any documented opt-in or fallback for other languages/locales.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

Natural-language content throughout the module docstring, CLI help, and status messages is presented only in Chinese, which effectively forces a specific language for users. The file does not offer language selection, fallback messaging, or a documented justification that the skill is intended only for a Chinese-language audience.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.