browser-toggle

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:04 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its browser-toggle purpose, but it gives risky install guidance through an unverified external archive and has an under-scoped restore command that can overwrite OpenClaw configuration from any file.

Install only from the reviewed ClawHub artifact or a verified maintainer source, not from the placeholder GitHub archive instructions in SHARE.md. Before using --restore, only pass backup files you trust from the OpenClaw backup directory, because the current implementation can replace the active OpenClaw config with arbitrary file contents. Review any sudo or deletion commands before copying them into a shell.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SHARE.md:24
• Finding: External Skill Archive Is Downloaded and Executed Without Enforced Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SHARE.md`, lines 24-39 **Vulnerability Type**: Remote payload retrieval and execution through an inconsistent, unverified release source **Risk Level**: High ### Vulnerable Code ```bash wget https://github.com/your-username/browser-toggle/releases/download/v1.0.0/browser-toggle-v1.0.0.tar.gz sha256sum browser-toggle-v1.0.0.tar.gz tar -xzf browser-toggle-v1.0.0.tar.gz cd browser-toggle-v1.0.0 bash setup.sh ``` ### Technical Analysis The installation instructions direct users to retrieve a Skill archive from an external GitHub namespace, extract it, and execute the included `setup.sh` script. The referenced `your-username` namespace is a placeholder and conflicts with the `yoo-unison` repository identity declared in `SKILL.md` and the placeholder repository metadata in `package.json`. A SHA-256 digest is documented, but the procedure merely prints the downloaded file's digest. It does not compare the result automatically against the expected value, and installation proceeds independently of verification. This makes the protection dependent on a user manually noticing a mismatch. Because the archive is retrieved at installation time rather than being part of the audited artifact, its effective executable contents can differ from the reviewed code. The remote archive may contain a modified `setup.sh`, replacement Python program, additional executable files, or other payloads. ### Attack Path 1. An attacker controls, acquires, or compromises the repository or release namespace referenced by the installation instructions. 2. The attacker publishes a malicious archive at the expected release URL. 3. A user follows `SHARE.md` and downloads the archive. 4. The user either skips the manual checksum comparison or fails to notice that the printed digest differs from the documented value. 5. The user extracts the archive and runs `bash setup.sh`. 6. The malicious installer executes with the privileges of the i ...[truncated 992 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace every placeholder repository URL with one canonical, verified maintainer repository. 2. Ensure `SHARE.md`, `SKILL.md`, `INSTALL.md`, and `package.json` identify the same owner and repository. 3. Enforce checksum verification before extraction or execution: ```bash printf '%s %s\n' \ '52e6793d41094b6495ce5a9ae165b9fa03947989d739290399a352e76d8b52c7' \ 'browser-toggle-v1.0.0.tar.gz' | sha256sum --check --strict - ``` 4. Stop installation immediately if integrity verification fails. 5. Publish cryptographically signed release artifacts and verify signatures against a maintainer key distributed through a separate trusted channel. 6. Pin downloads to immutable release assets or commit identifiers. 7. Advise users to inspect extracted files before executing the installer and not to run the installation as root. 8. Prefer distribution through the trusted Skill registry so the installed artifact is identical to the reviewed artifact. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: browser_toggle.py:123
• Finding: Unvalidated Restore Operation Can Replace the Active OpenClaw Configuration With an Arbitrary File<![CDATA[ ## Vulnerability Details **File Location**: `browser_toggle.py`, lines 123-137 and 239-245 **Vulnerability Type**: Unrestricted file restore and missing configuration validation **Risk Level**: Medium ### Vulnerable Code ```python def restore_from_backup(self, backup_file: str) -> bool: try: backup_path = Path(backup_file) if not backup_path.exists(): return False shutil.copy2(backup_path, self.config_file) return True except Exception: return False ``` The command-line path reaches this operation directly: ```python elif args.restore: if toggle.restore_from_backup(args.restore): print("\n✅ 恢复成功！") sys.exit(0) else: print("\n❌ 恢复失败！") sys.exit(1) ``` ### Technical Analysis The `--restore` option accepts any existing path accessible to the invoking user. The implementation does not: - Restrict the source to the designated OpenClaw backup directory. - Verify that the source is a regular file. - Reject symbolic links. - Parse the source as JSON before overwriting the active configuration. - Validate the restored data against an expected OpenClaw configuration schema. - Create a backup of the current configuration before restoration. - Perform an atomic replacement. Consequently, any readable file can be copied over `~/.openclaw/openclaw.json`. An invalid file can make the configuration unreadable, while an attacker-controlled valid JSON file can introduce arbitrary settings recognized by OpenClaw. `shutil.copy2` also copies source metadata, which may apply inappropriate permission or timestamp metadata to the active configuration. ### Attack Path 1. An attacker places or supplies a crafted file at a location readable by the victim. 2. The attacker persuades the user or an automation process to run: ```bash openclaw-browser --restore /path/to/attacker-controlled-file ``` 3. The program checks only that the supplied path exists. 4. The supplied f ...[truncated 1173 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve the supplied path and require it to remain inside `self.backup_dir`. 2. Reject symbolic links and require a regular file. 3. Parse the source with `json.load` before modifying the active configuration. 4. Validate the parsed object against an explicit allowlist or OpenClaw configuration schema. 5. Confirm that the backup has the expected filename format and, where possible, verify an integrity digest or authenticated manifest. 6. Back up the current active configuration before every restore operation. 7. Write the validated configuration to a securely created temporary file in the same directory and replace the destination atomically with `os.replace`. 8. Explicitly set restrictive destination permissions rather than inheriting source metadata through `shutil.copy2`. 9. Consider requiring interactive confirmation when restoring a file not generated by the current installation. Example path restriction: ```python backup_root = self.backup_dir.resolve() backup_path = Path(backup_file).expanduser() if backup_path.is_symlink() or not backup_path.is_file(): return False resolved_path = backup_path.resolve() if resolved_path.parent != backup_root: return False with resolved_path.open("r", encoding="utf-8") as source: restored_config = json.load(source) if not isinstance(restored_config, dict): return False ``` ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (27)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

openclaw gateway restart

# 2. 删除 Skill
rm -rf ~/.openclaw/workspace/skills/browser-toggle

# 3. 删除全局命令（如果存在）
sudo rm -f /usr/local/bin/openclaw-browser

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

openclaw gateway restart

# 2. 删除 Skill
rm -rf ~/.openclaw/workspace/skills/browser-toggle

# 3. 删除全局命令（如果存在）
sudo rm -f /usr/local/bin/openclaw-browser

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm -rf ~/.openclaw/workspace/skills/browser-toggle

# 3. 删除全局命令（如果存在）
sudo rm -f /usr/local/bin/openclaw-browser
```

---

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

openclaw gateway restart

# 2. 删除 Skill
rm -rf ~/.openclaw/workspace/skills/browser-toggle

# 3. 删除全局命令（如果存在）
sudo rm -f /usr/local/bin/openclaw-browser

• Confidence: 93% confidence
• Finding: The command `rm -rf ~/.openclaw/workspace/skills/browser-toggle` recursively deletes a directory and is presented as a copy-paste uninstall step without an explicit warning. Even though the path is specific to the skill, recursive force deletion is risky in documentation because path mistakes, symlink surprises, or user misunderstanding can cause unintended data loss.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

openclaw gateway restart

# 2. 删除 Skill
rm -rf ~/.openclaw/workspace/skills/browser-toggle

# 3. 删除全局命令（如果存在）
sudo rm -f /usr/local/bin/openclaw-browser

• Confidence: 93% confidence
• Finding: The command `rm -rf ~/.openclaw/workspace/skills/browser-toggle` recursively deletes a directory and is presented as a copy-paste uninstall step without an explicit warning. Even though the path is specific to the skill, recursive force deletion is risky in documentation because path mistakes, symlink surprises, or user misunderstanding can cause unintended data loss.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm -rf ~/.openclaw/workspace/skills/browser-toggle

# 3. 删除全局命令（如果存在）
sudo rm -f /usr/local/bin/openclaw-browser
```

---

• Confidence: 89% confidence
• Finding: The command `rm -f /usr/local/bin/openclaw-browser` removes a file from a privileged system path and may be executed with `sudo`, making it sensitive. In documentation, direct destructive commands against system locations are dangerous if presented without explanation, validation, or warnings, because users may remove the wrong file or normalize unsafe copy-paste behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 删除不必要的文件
echo "🗑️ 删除不必要的文件..."
rm -f "$BUILD_DIR"/*.pyc
rm -rf "$BUILD_DIR"/__pycache__
rm -f "$BUILD_DIR"/dist/*.tar.gz 2>/dev/null || true

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 删除不必要的文件
echo "🗑️ 删除不必要的文件..."
rm -f "$BUILD_DIR"/*.pyc
rm -rf "$BUILD_DIR"/__pycache__
rm -f "$BUILD_DIR"/dist/*.tar.gz 2>/dev/null || true

# 创建 README

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "🗑️ 删除不必要的文件..."
rm -f "$BUILD_DIR"/*.pyc
rm -rf "$BUILD_DIR"/__pycache__
rm -f "$BUILD_DIR"/dist/*.tar.gz 2>/dev/null || true

# 创建 README
echo "📝 创建发布说明..."

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file forces Chinese-language instructions throughout, including the title, headings, warnings, and command descriptions, with no indication that this skill is region-specific or that users may choose another language. Per the policy, imposing a specific language without user opt-in is a natural-language policy violation.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 1. 创建 Skill 目录
mkdir -p ~/.openclaw/workspace/skills/browser-toggle

# 2. 复制文件
cp browser_toggle.py ~/.openclaw/workspace/skills/browser-toggle/

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 安装 Chrome
wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
sudo dpkg -i google-chrome-stable_current_amd64.deb
sudo apt-get install -f -y
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 安装 Chrome
wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
sudo dpkg -i google-chrome-stable_current_amd64.deb
sudo apt-get install -f -y
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 安装 Chrome
wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
sudo dpkg -i google-chrome-stable_current_amd64.deb
sudo apt-get install -f -y
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 安装 Chrome
wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
sudo dpkg -i google-chrome-stable_current_amd64.deb
sudo apt-get install -f -y
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 安装 Chrome
wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
sudo dpkg -i google-chrome-stable_current_amd64.deb
sudo apt-get install -f -y
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 安装 Chrome
wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
sudo dpkg -i google-chrome-stable_current_amd64.deb
sudo apt-get install -f -y
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown file includes `rm -rf ~/.openclaw/workspace/skills/browser-toggle` and `sudo rm -f /usr/local/bin/openclaw-browser` as uninstall steps, which are destructive operations. While the section labels them as uninstall actions, the document does not explicitly warn users that these commands permanently delete files and may remove the installed skill or global command irreversibly.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: All user-facing instructions and descriptions in the file are presented only in Chinese, and the document does not indicate that this language choice is optional or region-specific. This can violate language/locale policy when a skill forces a specific language without user opt-in.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The uninstall section includes destructive deletion commands (`rm -rf` and `sudo rm -f`) without an explicit warning that they permanently remove files and may require elevated privileges. In documentation, this is dangerous because users may copy-paste commands blindly, leading to unintended data loss or removal of the wrong path if the command is modified or variables resolve unexpectedly.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

rm -rf ~/.openclaw/workspace/skills/browser-toggle

# 3. 删除全局命令（如果存在）
sudo rm -f /usr/local/bin/openclaw-browser
```

---

• Confidence: 88% confidence
• Finding: The documentation instructs users to run `sudo rm -f /usr/local/bin/openclaw-browser`, which performs privileged deletion without a warning or verification step. In a skill-installation context, privileged file deletion is sensitive because users may copy-paste it without confirming the target or understanding the impact.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The user-facing title/description text is written in Chinese and does not indicate that other languages are supported or that the locale restriction is intentional. The policy requires avoiding language or locale constraints unless the skill offers opt-in choice or clearly documents a justified region-specific limitation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The script's comments, console messages, and the generated RELEASE.md content are entirely in Chinese, which imposes a specific language on users and operators. Under the policy, this is a natural-language locale violation because there is no opt-in, alternate language, or stated region-specific justification.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The script's comments and nearly all user-facing status/help messages are in Chinese, which imposes a specific language on users. The file does not offer an alternative language, opt-in, or any justification that this skill is intended only for a Chinese-language environment.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: This markdown file describes behavior that enables/disables the browser by changing configuration state, including automatic backup and recovery, but it does not explicitly warn users that configuration files will be modified. For markdown skills, operations affecting user data or system integrity should be disclosed so users understand the impact before running the skill.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: INSTALL.md:197

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SHARE.md:199