Is browser-automation safe?
https://clawhub.ai/peytoncasper/browser-automation
This browser automation skill is a legitimate tool wrapping Stagehand/Playwright for AI-driven browser control, but it carries significant inherent risk. The combination of unrestricted Bash access, full network capability, persistent credential storage, and an opaque dependency chain (no package.json available for inspection) creates multiple attack surfaces. The most concerning vector is second-stage prompt injection via malicious web page content processed by the LLM. No active malicious behavior was detected during installation, and canary files were untouched, but the .env and AWS credentials were accessed during the clone process.
Category Scores
Findings (11)
HIGH Opaque dependency chain — no package.json provided -35 ▶
The skill requires running npm install and npm link but no package.json was included in the audit artifacts. This means the full dependency tree, including any preinstall/postinstall lifecycle scripts, cannot be inspected. An attacker could embed arbitrary code execution in install scripts.
HIGH Unrestricted browser network access with credential exposure -35 ▶
The browser has full network access and can navigate to any URL. Combined with automatic .env file reading for API keys and a persistent Chrome profile that stores cookies and passwords, this creates multiple data exfiltration pathways. The agent could be instructed (or manipulated via web page content) to navigate to an attacker-controlled site with sensitive data encoded in URLs.
HIGH Clone process accessed .env and AWS credentials -20 ▶
Filesystem monitoring shows the installation process read /home/oc-exec/.env and /home/oc-exec/.aws/credentials. While this may be the OpenClaw framework reading its own configuration, these files could contain sensitive secrets. No outbound network connections were observed, but the access itself is concerning.
MEDIUM Broad Bash tool access request -15 ▶
The skill requests allowed-tools: Bash which grants unrestricted shell command execution. While browser automation legitimately needs shell access to invoke the CLI, this permission allows any shell command, not just the browser command. A prompt injection via web page content could escalate this to arbitrary command execution.
MEDIUM Normalizes reading .env files for credentials -10 ▶
The skill instructs the agent to check .env files for API keys (BROWSERBASE_API_KEY, ANTHROPIC_API_KEY) as part of normal operation. This trains the agent to treat reading credential files as routine behavior, which could be exploited by other skills or prompt injections.
MEDIUM npm link creates persistent global CLI command -15 ▶
The npm link command creates a globally accessible browser command that persists beyond the skill's directory scope. This means the executable remains available system-wide even if the skill is removed, and could be invoked by other processes or skills.
MEDIUM Chrome remote debugging port exposed on localhost -10 ▶
Chrome is launched with --remote-debugging-port=9222, exposing a CDP endpoint on localhost. Any local process can connect to this port and execute arbitrary JavaScript in the browser context, access cookies, or manipulate page content.
MEDIUM Web page content as second-stage prompt injection vector -40 ▶
When the agent navigates to a web page and extracts or observes content, malicious page content could contain prompt injection instructions. Since the extracted text is processed by the LLM, an attacker-controlled web page could instruct the agent to exfiltrate data, run shell commands, or modify files.
LOW Persistent Chrome profile enables session hijacking -15 ▶
The .chrome-profile/ directory persists authentication cookies and saved passwords across sessions. If a user logs into a sensitive service during one session, those credentials remain accessible in subsequent sessions and could be replayed.
LOW Temp file creation during installation -10 ▶
The installation process created directories and files in /tmp/ (openclaw-1000/ and jiti/). These appear to be OpenClaw framework compilation artifacts rather than skill-specific behavior, but they write outside the skill directory.
INFO Auto-download with no restrictions -5 ▶
CDP download behavior is configured to automatically save all files with no type restrictions. While this is a feature, it could be exploited to download malicious executables.