ClawHub
Back to skill

Security audit

Browser CDP Connect

Security checks for vulnerabilities and agentic risk

Overview

This skill is not covert malware, but it deliberately gives the agent access to a logged-in personal Chrome profile to bypass site blocking, which exposes accounts, cookies, tabs, and browser actions.

Install only after reading it carefully and only if you intentionally want an agent to control a browser profile. Use a dedicated Chrome profile with only the minimum needed accounts, avoid email, financial, admin, or identity-provider sessions, confirm each use, close created tabs, and clear browser.cdp_url immediately afterward. Do not use it to bypass access controls or site rules you are not authorized to bypass.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/connect-chrome.sh:69
Finding

Persistent Profile-Wide Control of the User's Authenticated Chrome Browser

Content
View full analysis

Vulnerability Details

File Location: scripts/connect-chrome.sh:69-73; supporting behavior is documented in SKILL.md:21-25, 41-53, 148-153
Vulnerability Type: Excessive privilege and authenticated browser access
Risk Level: High

Vulnerable Code

bash
# --- 写入 Hermes config ---
WS_URL_FOR_CONFIG="$WS_URL"
if command -v hermes >/dev/null 2>&1; then
    hermes config set browser.cdp_url "$WS_URL_FOR_CONFIG" 2>&1 | grep -v "^$" || true
    echo "config: browser.cdp_url set"

Technical Analysis

The script persistently configures Hermes to connect through Chrome DevTools Protocol to the user's ordinary Chrome profile. The project documentation explicitly states that this profile contains the user's existing cookies and authenticated sessions and that all browser tabs are shared.

CDP access is not limited to a single target website, isolated tab, or narrowly scoped account. It can permit browser automation to inspect page content, navigate authenticated applications, execute JavaScript in page contexts, and perform actions through any sessions available in the connected profile.

The endpoint is written to persistent Hermes configuration rather than being restricted to the lifetime of the script. The documentation notes that new sessions continue to read this configuration until browser.cdp_url is manually cleared. Consequently, the privilege remains available after the immediate task has ended.

Attack Path

  1. The user enables remote debugging for their everyday Chrome instance.
  2. The user runs connect-chrome.sh.
  3. The script reads the browser-level CDP endpoint from DevToolsActivePort.
  4. The script persistently writes that endpoint to browser.cdp_url.
  5. Hermes browser operations attach to the user's daily Chrome profile.
  6. A compromised, malicious, or incorrectly directed agent navigates to an unrelated authenticated service or accesses an existing sensi ...[truncated 851 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require a dedicated Chrome profile containing only the accounts and data necessary for the task.
  2. Display an explicit confirmation that CDP grants control over all tabs and authenticated sessions in the selected profile.
  3. Prefer an ephemeral connection mechanism instead of writing the endpoint into persistent configuration.
  4. Automatically clear browser.cdp_url on normal exit and through an EXIT, INT, and TERM trap.
  5. Save and restore any preexisting configuration value rather than unconditionally replacing it.
  6. Restrict allowed origins or destinations in the browser integration where technically possible.
  7. Close tabs created by the agent and disconnect immediately after the approved operation.
  8. Do not recommend connecting a browser profile containing high-value administrative, financial, email, or identity-provider sessions.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/connect-chrome.sh:76
Finding

Python Code Injection Through Unsafely Interpolated Configuration Values

Content
View full analysis

Vulnerability Details

File Location: scripts/connect-chrome.sh:76-88
Vulnerability Type: Python source injection
Risk Level: Medium

Vulnerable Code

bash
CONFIG_PATH="${HERMES_CONFIG:-$LOCALAPPDATA/hermes/config.yaml}"
if [ -f "$CONFIG_PATH" ]; then
    python -c "
import yaml, sys
path = r'$CONFIG_PATH'
with open(path, 'r', encoding='utf-8') as f:
    cfg = yaml.safe_load(f)
cfg.setdefault('browser', {})['cdp_url'] = r'$WS_URL_FOR_CONFIG'
with open(path, 'w', encoding='utf-8') as f:
    yaml.dump(cfg, f, allow_unicode=True, default_flow_style=False)
print('config: browser.cdp_url set (manual)')
" 2>&1 || echo "config: failed to write (edit $CONFIG_PATH manually)"

Technical Analysis

The fallback configuration writer embeds shell variables directly into source code passed to python -c. Both CONFIG_PATH and WS_URL_FOR_CONFIG can contain characters that terminate the raw single-quoted Python string and introduce additional Python statements.

CONFIG_PATH may be influenced through the HERMES_CONFIG environment variable. WS_URL_FOR_CONFIG incorporates values read from Chrome's DevToolsActivePort file, especially its second line. Neither value is encoded as a Python string literal or validated against a strict format before interpolation.

Shell quoting does not prevent this vulnerability because the injected content is interpreted at the subsequent Python parsing layer. An input containing a single quote followed by valid Python syntax can escape the generated raw string and execute arbitrary Python code.

The vulnerable branch is reached when the hermes executable is unavailable from PATH and the selected configuration file exists.

Attack Path

  1. An attacker or untrusted launch environment supplies a crafted HERMES_CONFIG value containing Python syntax, or modifies the second line of DevToolsActivePort.
  2. The attacker ensures that hermes is no ...[truncated 1205 chars]
Remediation
View remediation

Remediation Suggestions

  1. Never interpolate shell variables into Python source code.

  2. Pass values as positional arguments and retrieve them through sys.argv, for example:

    bash
    python - "$CONFIG_PATH" "$WS_URL_FOR_CONFIG" <<'PY'
import sys
import yaml

path = sys.argv[1]
ws_url = sys.argv[2]

with open(path, "r", encoding="utf-8") as handle:
    config = yaml.safe_load(handle) or {}

config.setdefault("browser", {})["cdp_url"] = ws_url

with open(path, "w", encoding="utf-8") as handle:
    yaml.safe_dump(
        config,
        handle,
        allow_unicode=True,
        default_flow_style=False,
    )
PY

  3. Validate PORT with an exact numeric expression and enforce the valid TCP port range of 1 through 65535.

  4. Validate WS_PATH against the expected Chrome path format, such as an exact /devtools/browser/<UUID> pattern.

  5. Reject embedded control characters, unexpected schemes, hosts other than loopback, and malformed WebSocket paths.

  6. Use a fixed, trusted Python executable where appropriate and avoid allowing an untrusted PATH to select the interpreter or related tools.

  7. Treat an empty YAML document safely by converting a None result from yaml.safe_load into an empty mapping before calling setdefault.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The description promotes connecting to the user's everyday Chrome specifically because it carries real login state and human fingerprints, but it does not place an up-front warning about the privacy and account-risk implications. This is dangerous because the agent would gain access to authenticated sessions, cookies, and live tabs in a browser the user actively uses, potentially enabling unintended actions or data exposure.

Content

No source excerpt is available for this finding.

Ssd 4

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly instructs the agent to switch from blocked headless automation to the user's normal Chrome to avoid anti-bot detection, relying on real login state and human behavioral signals. That is dangerous because it operationalizes circumvention of site protections and leverages the user's authenticated environment as a stealth mechanism, increasing legal, privacy, and account-abuse risk.

Content

No source excerpt is available for this finding.

Ssd 4

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This section provides a concrete workflow for discovering the DevTools WebSocket endpoint from the local Chrome profile and wiring it into Hermes so the agent can operate through the user's existing authenticated browser. In context, that materially lowers the barrier to using the user's live session and identity to access sites that already rejected automation, making abuse easier and more scalable.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs use of shell commands that read sensitive local files and modify Hermes configuration, but it does not declare any tool scope or permissions boundaries. That omission increases the chance the agent can access or change local state without explicit review, especially when the workflow targets the user's real browser profile and authenticated session.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad enough to activate on generic mentions like '登录态', '用我的浏览器', '反爬', or a forbidden response, which can cause the skill to engage in a high-risk browser takeover flow without narrowly confirming user intent. In this context, overbroad activation is dangerous because the skill pivots into the user's daily Chrome, exposing live cookies, sessions, and visible browser state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This shell script includes its descriptive comments and several user-facing status/error messages in Chinese, without offering a language choice or documenting a locale-specific constraint. That can violate language/locale policy when users are not explicitly opting into Chinese or told the skill is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The natural-language instructions and description are entirely in Chinese, but the file does not indicate that the skill is intentionally limited to Chinese-speaking users or offer a language/locale choice. This can violate language or locale policy where user opt-in or explicit justification is required.

Content

No source excerpt is available for this finding.