ClawHub
Back to skill

Security audit

OpenClaw Native Browser

Security checks for vulnerabilities and agentic risk

Overview

This browser skill has a coherent purpose, but it should be reviewed carefully because it installs unpinned remote code, handles logins and persistent cookies, and recommends globally replacing built-in web tools.

Install only if you trust the external repository and are comfortable with this skill handling authenticated browsing sessions. Prefer a pinned, reviewed commit, keep built-in web tools enabled unless you deliberately want this replacement, avoid hardcoding passwords, and use separate or disposable browser profiles for sensitive accounts.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:29
Finding

Mutable Remote Repository Is Retrieved and Installed as Executable Code

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29–31
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Medium

bash
git clone https://github.com/yungookim/openclaw-browser.git ~/clawd/openclaw-browser
cd ~/clawd/openclaw-browser
pip install -e .

Technical Analysis

The installation instructions clone the mutable default branch of a third-party GitHub repository and install it as executable Python code. No immutable commit, signed release, checksum, or other integrity constraint is specified.

As a result, the code executed by users can differ from the code that existed when this Skill was reviewed. The supplied artifact contains only SKILL.md; therefore, the remotely retrieved implementation—including its handling of passwords, cookies, browser sessions, and subprocesses—cannot be verified through this audit.

Editable installation through pip install -e . makes the cloned source directly importable and may also execute package build or installation logic. There is no evidence in the audited artifact that the referenced repository is currently malicious, but repository compromise, ownership transfer, or a malicious future update would create a direct execution channel.

Attack Path

  1. An attacker compromises the referenced GitHub account or repository, or causes malicious code to be added to its default branch.
  2. A user follows the documented installation procedure without pinning or verifying the retrieved revision.
  3. pip install -e . processes attacker-controlled packaging logic and installs the remote project.
  4. The user or agent imports and invokes OpenClawBrowserSkill.
  5. The malicious implementation executes with the privileges of the OpenClaw process.
  6. Because the browser is intended to handle authenticated sites, the implementation could access credentials supplied to login helpers, persistent cookies, DOM content, and browsing activity, then t ...[truncated 833 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the repository to a specific, reviewed commit hash rather than cloning a mutable default branch.
  • Prefer a signed, versioned release and verify its signature or cryptographic checksum before installation.
  • Vendor the reviewed implementation into the Skill package so the audited artifact contains the code that will execute.
  • Lock all transitive Python dependencies with exact versions and hashes.
  • Avoid editable installation for production use; build and install a reproducible artifact instead.
  • Publish the source and dependency review results for the exact pinned revision.
  • Run the browser implementation in a sandbox with restricted filesystem access, a minimal environment, and narrowly scoped network permissions.
  • Do not pass credentials to the implementation until its credential handling, logging, IPC, cookie storage, and outbound network destinations have been independently reviewed.

T07 · Tool Hijacking and Spoofing

Warning
Location
SKILL.md:88
Finding

Persistent Disabling of Built-In Web Tools Routes Tasks Through an Unverified Replacement

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 88–103
Vulnerability Type: Tool hijacking and replacement
Risk Level: Medium

text
To avoid `missing_brave_api_key` errors and ensure OpenClaw routes web tasks through openclaw-browser, disable the built-in web tools:

Edit `~/.openclaw/openclaw.json`:
json
{
  "tools": {
    "web": {
      "search": {
        "enabled": false
      },
      "fetch": {
        "enabled": false
      }
    }
  }
}
text
Or run:
bash
openclaw configure --section tools
text
and disable both `web.search` and `web.fetch`.

Technical Analysis

The Skill recommends persistently disabling OpenClaw's built-in search and fetch tools specifically to ensure that web tasks are routed through openclaw-browser. This configuration change is not necessary merely to make an additional browser available and removes trusted fallback paths.

The replacement implementation is not included in the audited artifact and is instead installed from a mutable external repository. Redirecting web tasks to that unverified component compounds the remote-code supply-chain risk and concentrates browsing activity, authenticated sessions, and sensitive page content in a single implementation.

The documented change affects the user's persistent OpenClaw configuration rather than being limited to one invocation. There is no evidence that it installs a hidden backdoor or directly alters safety constraints, but it deliberately replaces the normal tool-routing path and may continue to affect later sessions.

Attack Path

  1. The user installs the externally retrieved browser implementation.
  2. The user follows the recommendation to disable web.search and web.fetch in ~/.openclaw/openclaw.json.
  3. OpenClaw can no longer use those built-in web tools for subsequent tasks.
  4. Web operations are instead routed through the thir ...[truncated 1024 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not recommend disabling built-in web tools as the default installation procedure.
  • Keep web.search and web.fetch enabled and require explicit, per-task selection of the native browser when interactive browsing is necessary.
  • If routing changes are required, scope them to the current task or session instead of editing persistent global configuration.
  • Clearly disclose that the browser implementation is externally sourced and handles sensitive authenticated data.
  • Provide exact rollback instructions for restoring both built-in tools.
  • Add destination restrictions, user confirmation for credential submission, and isolation between authenticated sites.
  • Minimize cookie access and avoid exposing all cookies unless explicitly required for a user-approved operation.
  • Pin and audit the replacement implementation before allowing it to handle authenticated sessions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill provides built-in login helpers for multiple third-party services and shows examples that pass credentials directly, but does not prominently warn users about the risks of entering credentials into an agent-controlled browser automation layer. This increases the chance of credential exposure through logs, prompts, screenshots, process inspection, or misuse of persistent authenticated sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly states elsewhere that cookies persist across invocations, but it does not surface this as a prominent warning to users before use. In a browser skill handling authenticated sites, silent session persistence can expose prior users' authenticated state, enable unintended account actions, and leak sensitive browsing/session data across tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.