ClawHub
Back to skill

Security audit

webclaw3 — Browser Automation with Your Own Logged-in Chrome

Security checks across malware telemetry and agentic risk

Overview

The skill’s browser-automation purpose is coherent, but it needs review because it installs and runs high-power local components and contains unsafe setup and local file-handling behavior.

Install only if you are comfortable giving this skill control of your logged-in Chrome session. Avoid the qoderclicn curl-to-bash path unless you independently trust and verify it, keep the local services running only when needed, do not enable the CDP fallback casually, and protect the ~/.webclaw3 access key/config files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

External Script Fetching

High
Category
Supply Chain
Content
|---|---|---|---|---|
| `claude-code` | Claude Code（cli） | `claude` | `npm i -g @anthropic-ai/claude-code` | https://code.claude.com/docs/en/quickstart |
| `workbuddy-cn` | **WorkBuddy 国内**（PC 桌面） | `codebuddy` | `npm install -g @tencent-ai/codebuddy-code` | https://www.codebuddy.cn/docs/cli/quickstart |
| `qoderwork-cn` | **QoderWork 国内**（PC 桌面） | `qoderclicn` | `curl -fsSL https://qoder.cn/install \| bash` | https://docs.qoder.cn/cli/qoder-cli-cn-get-started-quickly |

> **装 CLI 直接用「安装命令」那一列，别再去翻 quickstart 文档。** 那列命令就是权威做法，复制到终端跑就行；最后一列的 quickstart 链接只是万一命令失败时的兜底参考，正常流程不用点。
Confidence
97% confidence
Finding
curl -fsSL https://qoder.cn/install \| bash

External Script Fetching

High
Category
Supply Chain
Content
const ENV_CLI = {
  'claude-code':  { type: 'claude-code',   binary: 'claude',     label: 'Claude Code',    doc: 'npm i -g @anthropic-ai/claude-code' },
  'workbuddy-cn': { type: 'codebuddy-code', binary: 'codebuddy',  label: 'WorkBuddy 国内', doc: 'npm install -g @tencent-ai/codebuddy-code' },
  'qoderwork-cn': { type: 'qoder-code',     binary: 'qoderclicn', label: 'QoderWork 国内', doc: 'curl -fsSL https://qoder.cn/install | bash' },
};

// dist/ 里的随包文件（扩展 zip、生成器 tarball）在导入部分 skill 平台时会被剥离，
Confidence
94% confidence
Finding
curl -fsSL https://qoder.cn/install | bash

Tool Parameter Abuse

High
Category
Tool Misuse
Content
return;
    }

    // DELETE /logs?logFile=xxx - 清空操作日志
    else if (pathname === '/logs' && req.method === 'DELETE') {
      const lf = q.logFile;
      try {
Confidence
97% confidence
Finding
DELETE /logs?logFile=xxx

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/webclaw3.mjs:250