stealth-browser

The skill is purpose-aligned with stealth browsing, but its core capabilities enable concealed automation and bypass of website security controls. It also forwards CAPTCHA credentials and challenge data to third parties, includes an HTTP key-transmission example, and stores reusable sessions locally. These are substantial risks; the supplied text does not establish confirmed malware.

This utility launches stealth-configured Chromium and optionally persists cookies and localStorage in plaintext under ~/.clawdbot/browser-sessions. Unvalidated session names permit path traversal, and values from session files are interpolated into browser JavaScript without escaping; these create security risks when inputs or session files are untrusted. Stealth settings and proxy support can facilitate automated browsing but are not, by themselves, evidence of malware. No explicit credential exfiltration or destructive behavior is present; overall severity is moderate, with relevant paths ~/.clawdbot/browser-sessions and ~/.clawdbot/secrets/proxies.json.

This is a browser session and profile manager that stores cookies and local storage in plaintext under ~/.clawdbot/browser-sessions and can apply them to browser pages. Unvalidated session and profile names permit path traversal, and crafted local-storage data can inject JavaScript through run_js or execute_script. The code shows no evidence of intentional malware, network exfiltration, or unauthorized remote access; severity is moderate due to filesystem and browser execution risks.

This utility saves website cookies and localStorage as plaintext JSON under ~/.clawdbot/browser-sessions and restores them in a browser; it does not show explicit network exfiltration or other malware behavior. The main security concerns are exposure of authentication credentials in local files and unsanitized session names that permit path traversal when reading, writing, or deleting session files. It also disables an automation-detection feature and uses a fixed user agent. Severity: moderate security risk; no malicious domain or external URL is embedded in the code.

This code automates login to a caller-selected website and saves browser cookies and attempt records locally. Its primary risks are unvalidated target URLs, plaintext session-cookie storage, credentials supplied on the command line, and path traversal through session_name, which can cause unintended local file reads or writes. It contains no evident independent exfiltration, destructive behavior, or remote-control mechanism; severity is moderate and depends on how it is invoked and protected.

This utility manages task state and logs under ~/.clawdbot/tasks and can execute commands through a shell when run_with_timeout is called. Untrusted cmd values can cause shell command injection, and unvalidated task names can enable path traversal for file reads or deletion. No network activity or credential theft is shown; severity is moderate and depends on whether these arguments are controlled by an untrusted party.