{
  "skill_name": "clawbrowser",
  "skill_path": "/workspace/skills/clawhub-clawbrowser",
  "skill_directory": "/workspace/skills/clawhub-clawbrowser",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 2,
  "findings": [
    {
      "id": "llm_finding_clawbrowser_0",
      "rule_id": "LLM_UNAUTHORIZED_TOOL_USE",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Overly Permissive Tool Restriction Pattern",
      "description": "The allowed-tools field uses a wildcard pattern 'Bash(playwright-cli:*)' which permits execution of ANY command starting with 'playwright-cli'. This broad permission could be exploited if an attacker can influence command arguments or if the playwright-cli tool itself has vulnerabilities. The wildcard pattern defeats the purpose of granular tool restrictions.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "allowed-tools: Bash(playwright-cli:*)",
      "remediation": "Replace the wildcard pattern with explicit allowed commands (e.g., 'Bash(playwright-cli open)', 'Bash(playwright-cli snapshot)', 'Bash(playwright-cli click)'). If wildcards are necessary, document the security implications and ensure input validation occurs before command execution.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The clawbrowser skill is a legitimate browser automation tool using Playwright CLI with MODERATE security concerns. The primary issues are: (1) overly permissive wildcard tool restrictions that could be tightened, (2) missing metadata reducing transparency, (3) incomplete documentation with truncated instructions and missing referenced files, and (4) lack of resource management guidance for persistent sessions. No evidence of malicious intent (data exfiltration, prompt injection, credential theft) was found. The skill performs its stated function of browser automation but would benefit from stricter tool permissions, complete documentation, and resource management guidelines.",
        "primary_threats": [
          "Tool restriction bypass potential via wildcards",
          "Missing transparency metadata",
          "Incomplete documentation",
          "Resource exhaustion risk from unbounded sessions"
        ],
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "aisubtech": "AISubtech-12.1.2",
        "aisubtech_name": "Tool Poisoning",
        "scanner_category": "SUSPICIOUS CODE EXECUTION",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "The wildcard is intentional for this use case. The tool restriction still provides meaningful isolation (only playwright-cli, not arbitrary bash). This is a design tradeoff, not a vulnerability.",
        "meta_exploitability": "Low - Requires attacker to control playwright-cli arguments, which are generated by the agent following skill instructions",
        "meta_impact": "Low - Limited to playwright-cli functionality, which is the skill's purpose"
      }
    },
    {
      "id": "llm_finding_clawbrowser_3",
      "rule_id": "LLM_RESOURCE_ABUSE",
      "category": "resource_abuse",
      "severity": "MEDIUM",
      "title": "Potential for Unbounded Browser Sessions",
      "description": "The skill encourages persistent browser sessions with cookies and storage but provides no guidance on session cleanup, timeout limits, or resource management. The instructions mention 'session-stop-all' and 'session-delete' but don't enforce or recommend regular cleanup. Accumulated sessions could lead to resource exhaustion.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "Use --session=<name> to keep cookies, storage, and tabs isolated per workflow. Sessions behave like persistent profiles: they remember auth state, history, and tabs between commands.",
      "remediation": "Add explicit guidance on session lifecycle management: (1) Recommend session cleanup after workflows complete, (2) Document maximum recommended session count, (3) Suggest timeout policies for idle sessions, (4) Add example cleanup commands to workflow templates.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The clawbrowser skill is a legitimate browser automation tool using Playwright CLI with MODERATE security concerns. The primary issues are: (1) overly permissive wildcard tool restrictions that could be tightened, (2) missing metadata reducing transparency, (3) incomplete documentation with truncated instructions and missing referenced files, and (4) lack of resource management guidance for persistent sessions. No evidence of malicious intent (data exfiltration, prompt injection, credential theft) was found. The skill performs its stated function of browser automation but would benefit from stricter tool permissions, complete documentation, and resource management guidelines.",
        "primary_threats": [
          "Tool restriction bypass potential via wildcards",
          "Missing transparency metadata",
          "Incomplete documentation",
          "Resource exhaustion risk from unbounded sessions"
        ],
        "aitech": "AITech-13.3",
        "aitech_name": "Availability Disruption",
        "aisubtech": "AISubtech-13.3.2",
        "aisubtech_name": "Compute Exhaustion",
        "scanner_category": "RESOURCE ABUSE",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "This is a legitimate operational concern for long-running agents, but the skill does document cleanup commands. The issue is lack of emphasis on when/why to use them.",
        "meta_exploitability": "Low - Requires prolonged agent operation without cleanup",
        "meta_impact": "Medium - Could lead to disk/memory exhaustion over time"
      }
    }
  ],
  "scan_duration_seconds": 25.162733793258667,
  "duration_ms": 25162,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-05T21:54:12.980258"
}