Unbrowse Openclaw

{
  "meta": {
    "document_id": "ssds:auto:unbrowse:1.0.0",
    "ssds_version": "0.2.0",
    "scanner_version": "0.4.0+fe6fd9123d50",
    "created_at": "2026-03-07T14:19:28.274Z",
    "created_by": {
      "agent": "safeagentskills-cli/generate-ssds"
    },
    "language": "en",
    "notes": "Auto-generated SSDS. Manual review recommended."
  },
  "skill": {
    "name": "Unbrowse Openclaw",
    "version": "1.0.0",
    "format": "agent_skill",
    "description": "Analyze any website's network traffic and turn it into reusable API skills backed by a shared marketplace. Skills discovered by any agent are published, scored, and reusable by all agents. Capture network traffic, discover API endpoints, learn patterns, execute learned skills, and manage auth for gated sites. Use when someone wants to extract structured data from a website, discover API endpoints, automate web interactions, or work without official API documentation.",
    "publisher": "unknown",
    "source": {
      "channel": "local"
    },
    "artifact": {
      "sha256": "a4b4b934a795aaafe86cd49b887bb608d957b296cc1e147b4febcb876f8dbbda",
      "hash_method": "files_sorted"
    }
  },
  "capabilities": {
    "execution": {
      "can_exec_shell": true,
      "can_exec_code": true,
      "privilege_level": "user",
      "can_install_deps": true,
      "can_persist": false
    },
    "filesystem": {
      "reads_workspace": true,
      "reads_user_home": true,
      "reads_system": false,
      "writes_workspace": true,
      "writes_user_home": true,
      "writes_system": false,
      "can_delete": true
    },
    "network": {
      "egress": "any",
      "ingress": true
    },
    "credentials": {
      "reads_env_vars": true,
      "reads_credential_files": true,
      "reads_browser_data": true,
      "reads_keychain": true
    },
    "services": [],
    "actions": {
      "can_send_messages": false,
      "can_post_public": false,
      "can_purchase": false,
      "can_transfer_money": false,
      "can_deploy": false,
      "can_delete_external": false
    },
    "prompt_injection_surfaces": [
      "web"
    ],
    "content_types": [
      "general"
    ]
  },
  "hazards": {
    "hdac": {
      "H": 4,
      "D": 4,
      "A": 1,
      "C": 1
    },
    "flags": [
      "EXEC",
      "CODE_EXEC",
      "FS_READ_WORKSPACE",
      "FS_READ_USER",
      "FS_WRITE_WORKSPACE",
      "FS_WRITE_USER",
      "FS_DELETE",
      "NET_EGRESS_ANY",
      "NET_INGRESS",
      "CREDS_ENV",
      "CREDS_FILES",
      "CREDS_BROWSER",
      "CREDS_KEYCHAIN",
      "PI_WEB"
    ],
    "custom_flags": [
      {
        "code": "CRED_BROWSER",
        "name": "Browser Profile Access",
        "description": "Accesses browser cookies/profiles in: src/api/routes.ts, src/auth/browser-cookies.ts, src/auth/index.ts"
      },
      {
        "code": "CRED_KEYCHAIN",
        "name": "Keychain Access",
        "description": "Accesses system keychain in: src/auth/browser-cookies.ts"
      },
      {
        "code": "FILE_DELETE",
        "name": "File Deletion",
        "description": "Can delete files in: src/auth/browser-cookies.ts"
      },
      {
        "code": "NET_INGRESS",
        "name": "Network Server",
        "description": "Listens for incoming connections in: src/index.ts"
      },
      {
        "code": "SOCIAL_ENGINEERING",
        "name": "Social Engineering Risk",
        "description": "SOCIAL_ENG_VAGUE_DESCRIPTION: Skill description is too vague or missing"
      },
      {
        "code": "COMMAND_INJECTION",
        "name": "Command Injection Risk",
        "description": "TIRITH_DOTFILE_OVERWRITE, MCP_CMD_DANGEROUS_SYSTEM, COMMAND_INJECTION_EVAL, MCP_SCRIPT_TAGS: Redirecting output to home directory dotfiles (shell config, SSH keys, etc.)"
      },
      {
        "code": "TOOL_POISONING",
        "name": "Tool Poisoning",
        "description": "Hidden secondary behavior detected: MCP_TOOL_POISONING_SENSITIVE_DATA"
      }
    ],
    "confidence": {
      "level": "medium",
      "basis": [
        "static_analysis"
      ],
      "notes": "Detected 7 security patterns (7 vendored rule hits). Review recommended."
    },
    "rationale": {
      "H": "H4: Critical: Privilege escalation or malware detected",
      "D": "D4: Critical: Credential theft or data exfiltration",
      "A": "A1: Local side effects only",
      "C": "C1: General content"
    }
  },
  "containment": {
    "level": "maximum",
    "required": [
      {
        "control": "SANDBOX_CONTAINER",
        "reason": "Code execution capability"
      }
    ],
    "recommended": [
      {
        "control": "LOG_ACTIONS",
        "reason": "Audit trail for all actions"
      }
    ],
    "uncontained_risk": "Risk level depends on manual review of actual capabilities."
  },
  "risks": {
    "risks": [
      {
        "risk": "Keychain/credential store access in: src/auth/browser-cookies.ts",
        "severity": "high",
        "mitigation": "Block keychain access or use isolated environment."
      },
      {
        "risk": "Command injection risk: TIRITH_DOTFILE_OVERWRITE, MCP_CMD_DANGEROUS_SYSTEM, COMMAND_INJECTION_EVAL, MCP_SCRIPT_TAGS",
        "severity": "critical"
      },
      {
        "risk": "Social engineering indicators: SOCIAL_ENG_VAGUE_DESCRIPTION",
        "severity": "low",
        "mitigation": "Provide clear, detailed description of skill functionality"
      },
      {
        "risk": "Tool poisoning: hidden behaviors detected (MCP_TOOL_POISONING_SENSITIVE_DATA)",
        "severity": "high",
        "mitigation": "Remove references to sensitive data collection."
      }
    ],
    "limitations": [
      "Static analysis only - runtime behavior not verified"
    ]
  },
  "incident_response": {
    "kill_switch": [
      "Stop the agent process"
    ],
    "containment": [
      "Review logs for unexpected actions"
    ],
    "recovery": [
      "Depends on skill capabilities"
    ]
  },
  "evidence": [
    {
      "evidence_id": "EV:file-1",
      "type": "file_excerpt",
      "title": "package.json",
      "file_path": "package.json"
    },
    {
      "evidence_id": "EV:file-2",
      "type": "file_excerpt",
      "title": "README.md",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:file-3",
      "type": "file_excerpt",
      "title": "SKILL.md",
      "file_path": "SKILL.md"
    },
    {
      "evidence_id": "EV:file-4",
      "type": "file_excerpt",
      "title": "src/api/routes.ts",
      "file_path": "src/api/routes.ts"
    },
    {
      "evidence_id": "EV:file-5",
      "type": "file_excerpt",
      "title": "src/auth/browser-cookies.ts",
      "file_path": "src/auth/browser-cookies.ts"
    },
    {
      "evidence_id": "EV:file-6",
      "type": "file_excerpt",
      "title": "src/auth/index.ts",
      "file_path": "src/auth/index.ts"
    },
    {
      "evidence_id": "EV:file-7",
      "type": "file_excerpt",
      "title": "src/capture/index.ts",
      "file_path": "src/capture/index.ts"
    },
    {
      "evidence_id": "EV:file-8",
      "type": "file_excerpt",
      "title": "src/cli.ts",
      "file_path": "src/cli.ts"
    },
    {
      "evidence_id": "EV:file-9",
      "type": "file_excerpt",
      "title": "src/client/index.ts",
      "file_path": "src/client/index.ts"
    },
    {
      "evidence_id": "EV:file-10",
      "type": "file_excerpt",
      "title": "src/domain.ts",
      "file_path": "src/domain.ts"
    },
    {
      "evidence_id": "EV:cisco-1",
      "type": "file_excerpt",
      "title": "MCP_TOOL_POISONING_SENSITIVE_DATA [HIGH] README.md:50: Skills are stored in a shared marketplace at `beta-api.unbrowse.ai`. On first st",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-2",
      "type": "file_excerpt",
      "title": "TIRITH_DOTFILE_OVERWRITE [HIGH] README.md:10: git clone <repo-url> ~/.agents/skills/unbrowse",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-3",
      "type": "file_excerpt",
      "title": "SOCIAL_ENG_VAGUE_DESCRIPTION [LOW] SKILL.md:194: ",
      "file_path": "SKILL.md"
    },
    {
      "evidence_id": "EV:cisco-4",
      "type": "file_excerpt",
      "title": "MCP_CMD_DANGEROUS_SYSTEM [CRITICAL] src/auth/browser-cookies.ts:187: const reg = getRegistrableDomain(domain);",
      "file_path": "src/auth/browser-cookies.ts"
    },
    {
      "evidence_id": "EV:cisco-5",
      "type": "file_excerpt",
      "title": "COMMAND_INJECTION_EVAL [CRITICAL] src/execution/index.ts:589: while ((m = templateVarRe.exec(endpoint.url_template)) !== null) {",
      "file_path": "src/execution/index.ts"
    },
    {
      "evidence_id": "EV:cisco-6",
      "type": "file_excerpt",
      "title": "MCP_SCRIPT_TAGS [HIGH] src/execution/index.ts:1215: .replace(/<script[\\s\\S]*?<\\/script>/gi, \"\")",
      "file_path": "src/execution/index.ts"
    },
    {
      "evidence_id": "EV:cisco-7",
      "type": "file_excerpt",
      "title": "MCP_SCRIPT_TAGS [HIGH] src/extraction/index.ts:53: // --- Next.js: <script id=\"__NEXT_DATA__\" type=\"application/json\"> ---",
      "file_path": "src/extraction/index.ts"
    }
  ]
}