Skills/ClawHub/testagent-browser-setup

testagent-browser-setup@1.0.10

BLOCKED· install only

Publisher claims: "One-time installation and initialization of Chromium, system dependencies, Chinese fonts, and the CDP launcher script in a fresh openclaw environment — no ro..." Observed in sandbox: reads credential files, sends data to cdn.playwright.dev.

Registry ClawHubPublisher wangyin717 · publishing for 114 daysInstalls 1,208Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-10 and scored it 30/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Pipe-to-shell pattern; Pipe-to-shell pattern. Summary: reads credential files, sends data to cdn.playwright.dev.

Behavior trace

Honeypot run · 10 s · 2 scenarios
t+CategoryObserved action
4.4sfilesystemread ~/work/acme-api/.npmrc · ~/.npmrc
4.4sfilesystemread ~/.cache/ms-playwright/ · ~/.npm/_logs · ~/.npm/_cacache/index-v5/70/14/07779d693b1d396f657f70ef9c62d36442eb9b1a4dd5ad623df9dd561a60 · ~/.npm/_npx/86170c4cd1c5da32/package.json · ~/.npm/_npx/86170c4cd1c5da32/node_modules/.package-lock.json · ~/.npm/_npx/86170c4cd1c5da32/node_modules outside project
4.4sfilesystemwrote ~/.npm/_cacache/tmp/f6278e80 · ~/.npm/_cacache/index-v5/70/14/07779d693b1d396f657f70ef9c62d36442eb9b1a4dd5ad623df9dd561a60 · ~/.npm/_cacache/tmp/bef867ac · ~/.npm/_cacache/tmp/e16e8b53 · ~/.npm/_cacache/tmp/2c9858e6 · ~/.npm/_cacache/tmp/ab9fb2cc
4.4snetworkCONNECT tcp://registry.npmjs.org:443
4.4snetworkCONNECT tcp://registry.npmjs.org:443
4.4snetworkCONNECT tcp://registry.npmjs.org:443
4.4snetworkCONNECT tcp://registry.npmjs.org:443
4.4snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
4.4snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
4.4snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
4.4snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
4.4snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
4.4sprocessexec /usr/bin/head
4.4sprocessexec /usr/bin/ls
4.4sprocessexec /usr/local/bin/npx
4.4sprocessexec /usr/bin/tail
4.4sprocessexec /tmp/ks-detonate-cykJOG/setup/home/.npm/_npx/86170c4cd1c5da32/node_modules/.bin/playwright-mcp
4.4sprocessexited 1:
4.4sprocessscript backend runs setup only
4.4sprocessscript backend runs setup only
7.3sprocesssecond launch, clock +45 days, CI unset
10sfilesystemread ~/work/acme-api/.npmrc · ~/.npmrc
10sfilesystemread ~/.cache/ms-playwright/ · ~/.npm/_logs · ~/.npm/_cacache/index-v5/70/14/07779d693b1d396f657f70ef9c62d36442eb9b1a4dd5ad623df9dd561a60 · ~/.npm/_cacache/content-v2/sha512/38/7b/aaeaf537ab31568ecdd38defa0892f7dcd6deff985f20de75efea2d7bc8aab2a5fe5da5a970a6f942466ea185abd4b5e0ecaaf3b3ec3e354b186a0b12fd5 · ~/.npm/_npx/86170c4cd1c5da32/package.json · ~/.npm/_npx/86170c4cd1c5da32/node_modules/.package-lock.json outside project
10sfilesystemwrote ~/.npm/_cacache/tmp/46d56edf · ~/.npm/_cacache/index-v5/70/14/07779d693b1d396f657f70ef9c62d36442eb9b1a4dd5ad623df9dd561a60 · ~/.cache/ms-playwright/.links/baddc2b5ea3dba77d3e9307f30f2ba471b2231c7
10snetworkCONNECT tcp://registry.npmjs.org:443
10snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
10snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
10snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
10snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
10snetworkCONNECT tcp://cdn.playwright.dev:443 · not in the allow-list, refused
10sprocessexec /usr/bin/head
10sprocessexec /usr/bin/ls
10sprocessexec /usr/local/bin/npx
10sprocessexec /usr/bin/tail
10sprocessexec /tmp/ks-detonate-cykJOG/later/home/.npm/_npx/86170c4cd1c5da32/node_modules/.bin/playwright-mcp
10sprocessexited 1:

Static findings

MEDIUM
File permission modification commandscripts/setup.sh:57 · File permission modification command — agent changes file ownership/permissionschmod +x "$HOME/.local/bin/chrome-cdp"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
CRITICAL
Pipe-to-shell patternscripts/setup-optional.sh:6 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -fsSL --retry 3 https://browser-use.com/cli/install.sh | bash || {Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Remote installer piped to shellscripts/setup-optional.sh:6 · Remote installer piped to shellcurl -fsSL --retry 3 https://browser-use.com/cli/install.sh | bash || {Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
LOW
Authorization escalation languageskill-card.md:3 · Authorization escalation language · informational: not an instruction fileOne-time installation and initialization of Chromium, browser dependencies, Chinese fonts, and a Chrome CDP launcher in a fresh OpenClaw environment without root access.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Remote installer piped to shellscripts/setup-optional.sh:8 · Remote installer piped to shellecho " curl -fsSL https://browser-use.com/cli/install.sh | bash"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/setup.sh:33 · npx invocation of non-well-known package — may execute untrusted codenpx @playwright/mcp install-browser chromium 2>&1 | tail -5Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/setup-optional.sh:14 · npx invocation of non-well-known package — may execute untrusted codeecho " npx skills add https://github.com/browser-use/browser-use --skill browser-use"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/setup-optional.sh:12 · npx invocation of non-well-known package — may execute untrusted codenpx skills add https://github.com/browser-use/browser-use --skill browser-use || {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Pipe-to-shell patternscripts/setup-optional.sh:8 · Pipe-to-shell pattern — downloads and immediately executes remote codeecho " curl -fsSL https://browser-use.com/cli/install.sh | bash"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06

Cost to the agent

Instructions loaded
≈734 tok
1 file · 5 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

50 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

An override rule (credential_read_plus_egress) caps this verdict regardless of the score. The first item below has to go before anything else counts.

  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs.
  2. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  3. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  4. Unclaimed publisher≈ +8 on the totalClaim wangyin717: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  5. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim wangyin717Propose a patch to the maintainer