Skills/ClawHub/headful-browser-vnc

headful-browser-vnc@2.0.0

CAUTION· static only

Publisher claims: "Run a persistent Linux Chrome session with VNC/noVNC human takeover and capture an existing tab through CDP. Use for remote browser workflows that need manual login, MFA, or operator inspection followed by automation." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher waylonsong · publishing for 2 daysInstalls 918Last detonated 2d ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-12 and scored it 51/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Privileged sudo commandscripts/setup.sh:30 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get updateFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsconfig.example.env:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Copy to .env and chmod 600. Use literal absolute paths; no $HOME or shell code.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandconfig.example.env:1 · File permission modification command — agent changes file ownership/permissions# Copy to .env and chmod 600. Use literal absolute paths; no $HOME or shell code.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsscripts/setup.sh:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "Set VNC_PASSFILE=$2 in .env (chmod 600) or your environment."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/setup.sh:31 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get install -y xvfb xauth x11vnc x11-utils fluxbox chromium fonts-noto-cjkFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/setup.sh:33 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get install -y novnc websockifyFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathstools/browser.py:73 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesresult = load_config(ROOT / '.env')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL with embedded credentialstests/export.test.js:109 · URL with embedded credentials — may be phishing or credential leakingassert.throws(() => options(['cookies', ...base, '--url', 'https://user:[email protected]']), /credentials/);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Access to sensitive file pathstests/test_browser.py:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconfig = self.directory / '.env'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/linux_integration.py:41 · Python subprocess execution detectedcompleted = subprocess.run([sys.executable, str(ROOT / 'tools/browser.py'), *args],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtools/browser.py:345 · Python subprocess execution detectedreturn subprocess.run(['xdpyinfo', '-display', display], stdout=subprocess.DEVNULL,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/linux_integration.py:34 · Python subprocess execution detectedcompleted = subprocess.run([sys.executable, str(ROOT / 'tools/browser.py'), 'stop', session],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtools/browser.py:491 · Python subprocess execution detectedcheck = subprocess.run(['node', '-e', "require('playwright'); if(Number(process.versions.node.split('.')[0]) < 22) process.exit(1)"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_browser.py:124 · Python subprocess execution detectedowned = subprocess.Popen(['sleep', '60'], start_new_session=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_browser.py:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconfig = self.directory / '.env'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/linux_integration.py:27 · Python subprocess execution detectedsubprocess.run(['x11vnc', '-storepasswd', 'testonly', self.env['VNC_PASSFILE']],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtools/browser.py:190 · Python subprocess execution detectedprocess = subprocess.Popen(command, stdin=subprocess.DEVNULL, stdout=fd, stderr=fd,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/setup.sh:20 · File permission modification command — agent changes file ownership/permissionschmod 600 "$2"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedtools/browser.py:442 · Python subprocess execution detectedcompleted = subprocess.run(command, capture_output=True, text=True, timeout=100)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/setup.sh:23 · File permission modification command — agent changes file ownership/permissionsecho "Set VNC_PASSFILE=$2 in .env (chmod 600) or your environment."Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedtests/test_browser.py:126 · Python subprocess execution detectedunrelated = subprocess.Popen(['sleep', '60'], start_new_session=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtools/browser.py:340 · Python subprocess execution detectedsubprocess.run(['xauth', '-f', str(auth), 'add', display, '.', secrets.token_hex(16)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/export.test.js:108 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.throws(() => options(['cookies', ...base, '--url', 'file:///etc/passwd']), /http/);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_browser.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconfig = self.directory / '.env'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈733 tok
1 file · 27 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

29 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim waylonsong: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  5. URL with embedded credentials≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim waylonsongPropose a patch to the maintainer