The skill enables arbitrary JavaScript execution
Claims to do
Agent Browser 技能: 智能浏览器控制助手。
Actually does
This skill utilizes an internal `browser` tool to perform web automation tasks. It can open specified URLs, take screenshots, click elements, type text, and execute arbitrary JavaScript via `browser_evaluate`. It stores screenshots and scraped data in `/workspace/data/browser/screenshots/` and `/workspace/data/browser/data/` respectively, and configuration in `/workspace/data/browser/config.json`.
openclaw skills install fhbillwer/ws-agent-browserThe skill exposes a `browser_evaluate` tool, allowing arbitrary JavaScript code execution within the browser context. This can lead to cross-site scripting (XSS), data exfiltration, credential theft, or potential browser sandbox escapes.
- `browser_evaluate` - 执行脚本
The skill's core functionality includes '数据抓取' (data scraping) and '提取网页内容' (extract webpage content), which can be abused to exfiltrate sensitive information from websites, leading to privacy violations or competitive intelligence gathering.
### 📥 数据抓取 - 提取网页内容 - 表格数据导出
The skill mentions '登录认证' (login authentication) and provides a `browser_type` tool. This combination could be used to interact with login forms and potentially harvest user credentials if not properly secured or monitored.
- 登录认证 - `browser_type` - 输入文字
Features like '批量操作' (batch operations) and '定时任务' (timed tasks) for '定期监控' (periodic monitoring) could be exploited to launch denial-of-service attacks or exhaust resources on target websites if not rate-limited or controlled.
- 批量操作 - 定时任务 - 定期监控
The skill has explicit write access to `/workspace/data/browser/` for storing screenshots and scraped data. While necessary for its function, this allows the agent to modify the file system, and this data could subsequently be accessed or exfiltrated by other means.
数据存储: - 截图/录屏:`/workspace/data/browser/screenshots/` - 抓取数据:`/workspace/data/browser/data/`
The skill hardcodes specific workspace directory paths for screenshots, scraped data, and configuration files. This discloses the internal filesystem structure of the agent's workspace environment, potentially aiding an attacker in targeting specific files.
- 截图/录屏:`/workspace/data/browser/screenshots/` - 抓取数据:`/workspace/data/browser/data/` - 配置:`/workspace/data/browser/config.json`
Long base64-encoded blob detected (potential hidden payload)
304502205c02c1ea86957276d0a274b909a4e0067db9ea8c5ca21de30747310b6f3dfabb022100cc035501daaa6e642da4c69ca11f72efa6fb970a6f5e26f711ebb9e3bf1ed3a9
Long base64-encoded blob detected (potential hidden payload)
3045022055ff431f1fac57a338871581c0d1ae5acd1b4c945ca1e40c60062b60cae4b531022100dd7076f1dbf9ed9d9cff03cb5b993b4f86f4988d6f289570a12a6eba8ef20409
The AIGC metadata block contains two fields 'ReservedCode1' and 'ReservedCode2' with long hex strings resembling DER-encoded ECDSA signatures. The purpose of these values is undeclared and opaque. They could represent watermarking, but their presence as 'reserved' fields with structured cryptographic data warrants scrutiny as potential steganographic or covert channel payloads.
ReservedCode1: 304502205c02c1ea86957276d0a274b909a4e0067db9ea8c5ca21de30747310b6f3dfabb022100cc035501daaa6e642da4c69ca11f72efa6fb970a6f5e26f711ebb9e3bf1ed3a9 ReservedCode2: 3045022055ff431f1fac57a338871581c0d1ae5acd1b4c945ca1e40c60062b60cae4b531022100dd7076f1dbf9ed9d9cff03cb5b993b4f86f4988d6f289570a12a6eba8ef20409
The skill supports '定时任务' (scheduled/timed tasks) and '定期监控' (periodic monitoring), enabling the agent to autonomously perform browser actions on a recurring basis without explicit user confirmation for each execution cycle. This represents unbounded autonomous action.
- 定时任务 ... 监控:每小时检查这个页面有无更新
The 'Security Notes' section makes reassuring but vague claims ('sensitive operations require confirmation', 'operation logs are traceable', 'follows robots.txt') without any enforced mechanism. These statements may create false confidence in human overseers reviewing the skill, reducing scrutiny of the powerful browser control capabilities being granted.
- 🔒 敏感操作需要确认 - 📝 操作日志可追溯 - ⚠️ 遵守网站 robots.txt
[](https://mondoo.com/ai-agent-security/skills/clawhub/fhbillwer/ws-agent-browser)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/fhbillwer/ws-agent-browser"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/fhbillwer/ws-agent-browser.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/fhbillwer/ws-agent-browser.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.