Security audit

WebSculpt

Security checks for vulnerabilities and agentic risk

Overview

This plugin is purpose-built for browser automation, but it gives agents broad access to a logged-in browser session and can persist or overwrite local automation commands.

Install only if you are comfortable letting an agent use your active browser login state and create or overwrite local WebSculpt commands. Use a separate browser profile with limited logged-in accounts, review generated or imported command packages before running them, prefer dry-run/import previews where available, and avoid using this with sensitive financial, admin, or private-account workflows unless you explicitly trust each command.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly instructs users to enable Chrome remote debugging and describes agent-driven browser automation against the user's live browser session. In this context, reuse of the active session's login state and cookies can let commands act with the user's authenticated privileges, creating privacy and account-impact risk if users do not understand the trust boundary or if a command is malicious or overly broad.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The README encourages exporting, importing, migrating, and sharing command libraries but does not warn that user-created commands and their accompanying artifacts may embed sensitive workflow details, URLs, selectors, context, or other metadata. Sharing such packages can unintentionally disclose internal tooling, browsing targets, or organization-specific automation knowledge.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to execute `capture finalize` and install a local executable command without re-confirming with the user. Because installation modifies the user's local command environment and creates runnable assets, this can cause unintended persistence or local capability changes if the user did not clearly consent to the write/install step at execution time.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The skill directs the agent to create a `.websculpt/captures/<name>/` workspace and populate several files, but it does not require a prominent user-facing warning about filesystem writes. Silent creation of directories and files is a safety issue because users may not expect local state changes or may be operating in sensitive repositories or directories.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The document explicitly instructs command authors how to read from and write to the local file system using the caller's working directory, but it does not warn that browser-runtime commands execute with access to local user data and may overwrite or exfiltrate files. In this skill context, commands also run with the user's existing browser session, which increases the sensitivity of any file I/O guidance because it normalizes powerful local access without requiring safety guardrails or path restrictions.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger condition is extremely broad: it applies to virtually any situation involving external information, internet access, websites, APIs, browser sessions, or even independent agent determination that web access is needed. This can cause the skill to activate far outside narrowly intended contexts, increasing the chance of unnecessary tool use, browser interaction, data exposure, and privilege expansion across ordinary tasks.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly directs the agent to run `finalize --force` and to do so without asking the user, which can overwrite an installed command and persist changes to the user's environment. Even though this is framed as a maintenance workflow, forced installation without an explicit confirmation or warning removes an important safety check and can lead to unintended or unsafe modifications being applied.

Unpinned Dependencies

Low

Category: Supply Chain
Content: "self-evolving" ], "dependencies": { "websculpt": "^0.3.10", "@playwright/cli": "0.1.13" }, "openclaw": {
Confidence: 94% confidence
Finding: The dependency on "websculpt" uses a caret range, which allows newer minor/patch versions to be installed without review. In a plugin that installs CLI tooling and exposes runtime extensions, this increases supply-chain risk because a compromised or breaking upstream release could be pulled in automatically.

Static analysis

No suspicious patterns detected.