Security audit

Clawbrowser Skill

Security checks for vulnerabilities and agentic risk

Overview

This browser automation skill has useful scraping features, but it can persist and upload scraped page data with weak scoping and insufficient user control.

Install only if you are comfortable with a browser automation skill that can scrape arbitrary pages, save page contents to disk, and upload scraped data to Feishu from CLI modes. Avoid using it on authenticated, internal, localhost, private-network, file://, or sensitive pages unless you have sandboxed the browser, disabled or reviewed Feishu export, and controlled the cache/output directories and npm dependency versions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: browser_tool_py36.py:180
Finding: Unrestricted URL Handling Enables Local File Access and Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: browser_tool_py36.py:210
Finding: Persistent Snapshot Cache Can Disclose Data Across URLs and Browser Sessions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:32
Finding: Unpinned Global npm and npx Dependencies Create a Supply-Chain Execution Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose emphasizes headless browser automation, ARIA refs, and natural-language control, but the described/observed behavior expands into scraping, local persistence, optional third-party document export, and batch/scheduled collection. This mismatch is dangerous because users and policy engines may approve the skill for limited UI automation while it also performs broader data collection and exfiltration-adjacent actions not clearly disclosed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file presents all user-facing instructions in Traditional Chinese, and there is no indication that other languages are supported or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The README instructs users to run npx clawhub without pinning an exact package version. Because npx resolves and executes whatever version is current at execution time, a compromised, typosquatted, or unexpectedly updated package could run arbitrary code on the user's system during publish operations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The verification command also uses npx clawhub without version pinning, creating the same supply-chain risk as the publish example. Users following the README may execute an unreviewed remote package version, which is especially risky because this skill is aimed at automation tooling and likely to be used in developer environments with broad local access.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises executable dependencies and browser automation behavior but does not declare any explicit tool scope or permissions boundaries. In an agent environment, this can lead to overbroad access to shell, filesystem, and environment capabilities, making unintended command execution, local file access, or data handling harder to constrain and review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documentation promotes live browser interaction and web scraping but does not warn users that actions may submit data to external sites, trigger state-changing clicks or form fills, or collect and store third-party content. In an agentic setting, lack of user-facing warning increases the risk of accidental data disclosure, unauthorized interaction with live services, and compliance issues around scraping.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The tool silently caches browser results to ~/.openclaw/cache/browser, potentially persisting page content, command results, and data from authenticated sessions to disk without disclosure or access controls. On multi-user systems or compromised endpoints, this can leak sensitive browsing data long after the browser session ends.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · browser_tool_py36.py (reported line 168)May include surrounding context.
python
full_cmd = base_cmd + cmd try: result = subprocess.run( full_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,

Unbounded Resource Access

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
Content: Scanner excerpt · browser_tool_py36.py (reported line 309)May include surrounding context.
python
else: return {"success": False, "error": "Traditional engine not implemented yet"} def wait(self, selector=None, timeout=None, text=None, load_state=None): """等待""" self._log("wait: selector=%s, timeout=%s, text=%s, load_state=%s" % ( selector, timeout, text, load_state))

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill exposes in-page JavaScript execution via the agent-browser eval command in helper methods. Even though the bundled snippets are static, the presence of eval-capable browser automation materially increases capability: if this wrapper is extended or combined with untrusted prompts, it can execute arbitrary script in the context of visited pages, enabling data extraction, DOM manipulation, and actions under the user's authenticated session.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest frames the skill as a general browser automation CLI with ARIA-based targeting and natural-language operation, while this module is purpose-built for scraping pages, extracting content/images/links, and persisting results. Those persistence and document-publication behaviors are not communicated by the manifest description and go beyond generic browser automation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The code transmits scraped page content to Feishu, an external service, even though that remote publication behavior is not reflected in the declared skill purpose. Hidden or under-disclosed outbound data transfer is dangerous because users may scrape internal, authenticated, or sensitive pages and unknowingly exfiltrate their contents to a third-party platform.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This section formats and exports full scraped content, including page text and possibly links/images, into Feishu documents. In the context of a browser automation skill, that creates a meaningful semantic data leakage risk because arbitrary visited pages may contain confidential user-visible information that is then copied to an external platform.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The scraper automatically persists extracted content, links, and images to local JSON and Markdown files without any retention controls, encryption, or sensitivity checks. For arbitrary webpages, especially authenticated or internal pages, this can leave readable copies of sensitive material on disk where other users, processes, or backups may access them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI paths invoke scrape/batch_scrape with save_to_feishu=True by default, causing automatic external transmission of scraped content without an explicit user warning or consent gate. This is especially risky for a browser-based scraper because operators may target pages containing private documents, authenticated content, or regulated data, resulting in unintentional data exfiltration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The screenshot method accepts an arbitrary path and forwards it directly to the external browser tool, enabling writes to attacker-chosen filesystem locations if an untrusted caller controls the argument. In an agent setting, this can overwrite files accessible to the current user or place sensitive screenshots in unsafe locations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The natural-language interface only recognizes hard-coded Chinese and English trigger verbs such as 打開/open, 點擊/click, and 填寫/fill. This constrains language behavior without any explicit user opt-in or documentation that the interface is limited to those locales.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The module docstrings, comments, help text, and user-facing output are all presented in Chinese, with no indication that the skill supports other languages or that Chinese is a deliberate locale-specific requirement. This can violate language/locale policy when users are not given an explicit language choice or opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest describes a CLI for headless browser automation, ARIA targeting, and natural-language operation, but this module also introduces cron-style scheduled execution driven by environment configuration. Using environment variables as an execution input channel is a separate operational capability not implied by the stated purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.