{
  "skill_name": "stealthy-auto-browse",
  "skill_path": "/workspace/skills/clawhub-stealthy-auto-browse",
  "skill_directory": "/workspace/skills/clawhub-stealthy-auto-browse",
  "is_safe": false,
  "max_severity": "CRITICAL",
  "findings_count": 5,
  "findings": [
    {
      "id": "llm_finding_stealthy-auto-browse_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Uncontrolled External Network Dependency with Arbitrary Command Execution",
      "description": "The skill requires connection to an external Docker container (stealthy-auto-browse) via STEALTHY_AUTO_BROWSE_URL environment variable. This container provides a headless browser with OS-level input control capabilities. The skill sends arbitrary commands to this external service without validation, creating a critical data exfiltration and command execution vector. An attacker controlling the container endpoint could intercept all browsing activity, credentials entered via system_type, and potentially execute arbitrary commands on the user's system through the browser automation API.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "Environment variable STEALTHY_AUTO_BROWSE_URL points to external service (http://localhost:8080 by default, but configurable to any URL). All API commands are POST requests to this endpoint with JSON payloads containing user data and browsing instructions. The system_type action sends keystrokes (potentially including passwords) to the external service.",
      "remediation": "1. Implement strict validation that STEALTHY_AUTO_BROWSE_URL must be localhost-only (reject non-localhost URLs). 2. Add authentication/authorization between skill and container. 3. Implement TLS for communication even on localhost. 4. Add explicit user consent before sending sensitive data (passwords, credentials) to the browser service. 5. Provide clear security warnings about the risks of browser automation with OS-level input.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill presents multiple severe security vulnerabilities. The primary threat is an uncontrolled external network dependency that sends arbitrary browsing commands and potentially sensitive data (including credentials typed via OS-level keyboard input) to a Docker container endpoint. The skill's explicit purpose is to evade bot detection and security controls, which is inherently deceptive and enables malicious use cases. The combination of external network communication, credential exposure via unencrypted keyboard input, lack of resource controls, and missing security metadata creates a high-risk attack surface. The skill should not be used in production environments without significant security hardening including localhost-only enforcement, encryption, authentication, and explicit user consent for sensitive operations.",
        "primary_threats": [
          "Data Exfiltration via External Network Dependency",
          "Credential Exposure via Unencrypted Keyboard Input",
          "Bot Detection Evasion and Security Control Bypass",
          "Uncontrolled Resource Consumption",
          "Missing Security Metadata and Transparency"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The skill explicitly documents sending arbitrary commands including passwords to a user-configurable URL. The default is localhost but nothing prevents changing it to an attacker-controlled server. This is a clear data exfiltration vector.",
        "meta_exploitability": "Easy - User only needs to modify environment variable or config file to redirect traffic",
        "meta_impact": "Critical - Complete credential theft, session hijacking, and browsing surveillance"
      }
    },
    {
      "id": "llm_finding_stealthy-auto-browse_1",
      "rule_id": "LLM_SOCIAL_ENGINEERING",
      "category": "social_engineering",
      "severity": "HIGH",
      "title": "Deceptive Purpose: Bot Detection Evasion Tool",
      "description": "The skill's explicit purpose is to evade bot detection systems using OS-level input manipulation and fingerprint spoofing. The description states it is 'completely undetectable by behavioral analysis' and designed to bypass security measures. This capability can be used for malicious purposes including: automated account creation, credential stuffing, scraping protected content, bypassing CAPTCHAs, and other activities that violate terms of service. The skill actively promotes deception and security evasion.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "Key phrases: 'evades bot detection', 'completely undetectable by behavioral analysis', 'Uses Camoufox (custom Firefox) with OS-level mouse/keyboard input', 'Generates consistent fingerprints via browserforge', 'Standard browser automation is detectable... This browser: Uses Firefox (no CDP exposure)'",
      "remediation": "1. Add explicit warnings about legal and ethical implications of bot detection evasion. 2. Implement usage restrictions and logging. 3. Require explicit user acknowledgment of terms of service compliance. 4. Consider whether this capability should be provided at all given its primary use case for circumventing security controls.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill presents multiple severe security vulnerabilities. The primary threat is an uncontrolled external network dependency that sends arbitrary browsing commands and potentially sensitive data (including credentials typed via OS-level keyboard input) to a Docker container endpoint. The skill's explicit purpose is to evade bot detection and security controls, which is inherently deceptive and enables malicious use cases. The combination of external network communication, credential exposure via unencrypted keyboard input, lack of resource controls, and missing security metadata creates a high-risk attack surface. The skill should not be used in production environments without significant security hardening including localhost-only enforcement, encryption, authentication, and explicit user consent for sensitive operations.",
        "primary_threats": [
          "Data Exfiltration via External Network Dependency",
          "Credential Exposure via Unencrypted Keyboard Input",
          "Bot Detection Evasion and Security Control Bypass",
          "Uncontrolled Resource Consumption",
          "Missing Security Metadata and Transparency"
        ],
        "aitech": "AITech-15.1",
        "aitech_name": "Harmful / Misleading / Inaccurate Content",
        "aisubtech": "AISubtech-15.1.1",
        "aisubtech_name": "Deceptive or Misleading Content",
        "scanner_category": "DECEPTIVE CONTENT",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The documentation explicitly states the purpose is to evade security controls. This is not a false positive - it's the core functionality.",
        "meta_exploitability": "Easy - The skill works as designed for evasion",
        "meta_impact": "High - Enables automated abuse of web services, ToS violations, potential legal liability"
      }
    },
    {
      "id": "llm_finding_stealthy-auto-browse_2",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "HIGH",
      "title": "Credential Exposure via Unencrypted OS-Level Keyboard Input",
      "description": "The system_type action sends keyboard input at the OS level to type text, including potentially sensitive data like passwords and credentials. This data is transmitted to the external browser service via HTTP POST requests. There is no indication of encryption, input sanitization, or special handling for sensitive data. Combined with the external network dependency, this creates a high-risk credential exposure vector.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "system_type action: {\"action\": \"system_type\", \"text\": \"hello world\", \"interval\": 0.08}. The 'text' parameter can contain any string including passwords. No encryption or sensitive data handling is mentioned. Communication protocol is HTTP POST to STEALTHY_AUTO_BROWSE_URL.",
      "remediation": "1. Implement end-to-end encryption for all data sent to the browser service. 2. Add explicit warnings before typing sensitive data. 3. Provide a secure input mode that masks/encrypts credentials. 4. Log all system_type operations for audit purposes. 5. Require user confirmation before sending potentially sensitive keystrokes.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill presents multiple severe security vulnerabilities. The primary threat is an uncontrolled external network dependency that sends arbitrary browsing commands and potentially sensitive data (including credentials typed via OS-level keyboard input) to a Docker container endpoint. The skill's explicit purpose is to evade bot detection and security controls, which is inherently deceptive and enables malicious use cases. The combination of external network communication, credential exposure via unencrypted keyboard input, lack of resource controls, and missing security metadata creates a high-risk attack surface. The skill should not be used in production environments without significant security hardening including localhost-only enforcement, encryption, authentication, and explicit user consent for sensitive operations.",
        "primary_threats": [
          "Data Exfiltration via External Network Dependency",
          "Credential Exposure via Unencrypted Keyboard Input",
          "Bot Detection Evasion and Security Control Bypass",
          "Uncontrolled Resource Consumption",
          "Missing Security Metadata and Transparency"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The documentation shows plaintext HTTP transmission of passwords. This is a confirmed security issue.",
        "meta_exploitability": "Medium - Requires local access or MITM position, but trivial for malware",
        "meta_impact": "High - Credential theft from unencrypted transmission"
      }
    },
    {
      "id": "llm_finding_stealthy-auto-browse_3",
      "rule_id": "LLM_SOCIAL_ENGINEERING",
      "category": "social_engineering",
      "severity": "MEDIUM",
      "title": "Misleading Compatibility and Security Implications",
      "description": "The skill manifest does not specify compatibility, allowed-tools, or license information, while requiring complex external dependencies (Docker container, VNC server, environment configuration). The description 'Control a stealthy browser that evades bot detection' downplays the security implications and potential for misuse. Users may not understand they are installing a tool designed to circumvent security controls.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "YAML manifest shows: license: Not specified, compatibility: Not specified, allowed-tools: Not specified. The setup requires Docker, port forwarding (8080, 5900), environment variable configuration, and external network access - none of which are declared in the manifest.",
      "remediation": "1. Add explicit compatibility field listing requirements (Docker, network access, VNC). 2. Specify allowed-tools to indicate network access requirements. 3. Add clear license information. 4. Include security warnings in the description about the tool's purpose and risks. 5. Document all external dependencies and their security implications.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill presents multiple severe security vulnerabilities. The primary threat is an uncontrolled external network dependency that sends arbitrary browsing commands and potentially sensitive data (including credentials typed via OS-level keyboard input) to a Docker container endpoint. The skill's explicit purpose is to evade bot detection and security controls, which is inherently deceptive and enables malicious use cases. The combination of external network communication, credential exposure via unencrypted keyboard input, lack of resource controls, and missing security metadata creates a high-risk attack surface. The skill should not be used in production environments without significant security hardening including localhost-only enforcement, encryption, authentication, and explicit user consent for sensitive operations.",
        "primary_threats": [
          "Data Exfiltration via External Network Dependency",
          "Credential Exposure via Unencrypted Keyboard Input",
          "Bot Detection Evasion and Security Control Bypass",
          "Uncontrolled Resource Consumption",
          "Missing Security Metadata and Transparency"
        ],
        "aitech": "AITech-2.1",
        "aitech_name": "Social Engineering",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "SOCIAL ENGINEERING",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The missing metadata is confirmed by examining the manifest. This is factual.",
        "meta_exploitability": "N/A - This is a transparency issue, not a direct exploit",
        "meta_impact": "Medium - Users cannot make informed decisions about security risks"
      }
    },
    {
      "id": "llm_finding_stealthy-auto-browse_4",
      "rule_id": "LLM_RESOURCE_ABUSE",
      "category": "resource_abuse",
      "severity": "MEDIUM",
      "title": "Uncontrolled Resource Consumption via External Browser",
      "description": "The skill connects to an external Docker container running a full browser with VNC server. There are no documented limits on: number of browser instances, memory usage, CPU consumption, network bandwidth, or session duration. The 'always: True' flag in metadata suggests persistent execution. An attacker or buggy code could spawn unlimited browser instances or create long-running sessions that exhaust system resources.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "Docker container runs browser + VNC server on ports 8080 and 5900. Metadata shows 'always': True indicating persistent availability. No resource limits, timeouts, or cleanup procedures are documented. The goto action supports 'networkidle' wait condition which could hang indefinitely.",
      "remediation": "1. Implement session timeouts and automatic cleanup. 2. Add resource limits (max memory, CPU, network bandwidth). 3. Limit number of concurrent browser instances. 4. Add timeout parameters to all blocking operations. 5. Implement health checks and automatic container restart. 6. Document resource requirements and cleanup procedures.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill presents multiple severe security vulnerabilities. The primary threat is an uncontrolled external network dependency that sends arbitrary browsing commands and potentially sensitive data (including credentials typed via OS-level keyboard input) to a Docker container endpoint. The skill's explicit purpose is to evade bot detection and security controls, which is inherently deceptive and enables malicious use cases. The combination of external network communication, credential exposure via unencrypted keyboard input, lack of resource controls, and missing security metadata creates a high-risk attack surface. The skill should not be used in production environments without significant security hardening including localhost-only enforcement, encryption, authentication, and explicit user consent for sensitive operations.",
        "primary_threats": [
          "Data Exfiltration via External Network Dependency",
          "Credential Exposure via Unencrypted Keyboard Input",
          "Bot Detection Evasion and Security Control Bypass",
          "Uncontrolled Resource Consumption",
          "Missing Security Metadata and Transparency"
        ],
        "aitech": "AITech-13.3",
        "aitech_name": "Availability Disruption",
        "aisubtech": "AISubtech-13.3.2",
        "aisubtech_name": "Compute Exhaustion",
        "scanner_category": "RESOURCE ABUSE",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "The lack of documented limits is confirmed, but actual resource abuse depends on usage patterns. This is a potential issue rather than active exploitation.",
        "meta_exploitability": "Medium - Requires intentional abuse or buggy code",
        "meta_impact": "Medium - DoS via resource exhaustion"
      }
    }
  ],
  "scan_duration_seconds": 43.74101138114929,
  "duration_ms": 43741,
  "analyzers_used": [
    "static_analyzer",
    "llm_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-07T20:44:27.434443"
}