stealth-browser Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower

Source:

SHA-256:

stealth-browser is an AI agent skill, created by mayuqi-crypto and published at openclaw/skills. ClawSecure audited stealth-browser across 10 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 10/100 (High Risk). The 19 findings concentrate in Data Exfiltration, Unauthorized Tool Use and Permissions Manifest, including Undeclared Network Access and Code block in SKILL.md at line 205 contains potentially…. None were rated high or critical severity.

Is stealth-browser safe?

ClawSecure audited stealth-browser and assigned a security score of 10/100 (High Risk), identifying 19 findings across Data Exfiltration and Unauthorized Tool Use. Review the findings below before installing.

What did ClawSecure find in stealth-browser?

ClawSecure identified 19 findings in stealth-browser, concentrated in Data Exfiltration, Unauthorized Tool Use and Permissions Manifest. The most severe include Undeclared Network Access and Code block in SKILL.md at line 205 contains potentially….

How was stealth-browser audited?

ClawSecure ran stealth-browser through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 10 files from openclaw/skills.

What does a score of 10 mean?

ClawSecure assigned stealth-browser a security score of 10/100, placing it in the High Risk range. This is driven by 19 findings led by Data Exfiltration that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for stealth-browser

ClawSecure detected 19 security findings in stealth-browser, spanning Data Exfiltration, Unauthorized Tool Use, Permissions Manifest and Policy Violation.

medium · Undeclared Network Access. Unauthorized Tool Use finding detected in SKILL.md.
medium · Code block in SKILL.md at line 205 contains potentially…. Data Exfiltration finding detected in SKILL.md:205.
medium · Outbound HTTP Request Detected. Data Exfiltration finding detected in scripts/cf_bypass.py:84.
medium · Outbound HTTP Request Detected. Data Exfiltration finding detected in scripts/cf_bypass.py:214.
medium · Outbound HTTP Request Detected. Data Exfiltration finding detected in scripts/proxy_rotate.py:154.
medium · Outbound HTTP Request Detected. Data Exfiltration finding detected in scripts/proxy_rotate.py:181.
medium · Outbound HTTP Request Detected. Data Exfiltration finding detected in scripts/solve_captcha.py:70.
medium · Outbound HTTP Request Detected. Data Exfiltration finding detected in scripts/solve_captcha.py:106.
medium · Outbound HTTP Request Detected. Data Exfiltration finding detected in scripts/solve_captcha.py:123.
medium · Outbound HTTP Request Detected. Data Exfiltration finding detected in scripts/solve_captcha.py:156.
medium · Outbound HTTP Request Detected. Data Exfiltration finding detected in scripts/solve_captcha.py:173.
medium · Outbound HTTP Request Detected. Data Exfiltration finding detected in scripts/solve_captcha.py:230.

Showing the 12 highest-severity of 19 findings. The full interactive list appears below.

3-Layer Audit Protocol

Security Recommendations for stealth-browser

Audit external network connections

stealth-browser sends data to external endpoints. Confirm each destination is expected and authorized, and remove any callback that exfiltrates data. ClawSecure monitors for known exfiltration and C2 endpoints.

Add a config.json permissions manifest

A config.json file declares what an agent component can access: file system, network, shell execution and more. Without it, users have no visibility into what the component can do before installing. This is the single most impactful security improvement for any AI agent skill.

Resolve policy violations

stealth-browser trips ClawSecure policy checks. Review each flagged pattern against your security policy and remediate or document an accepted exception before production use.

Related Security Research

ClawHavoc Explained: The Malware Family Targeting AI Agents→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→

Related AI Agent Security Audits

@martian-engineering/lossless-clawScore 25/100 openclaw-dashboard-repoScore 25/100 @martian-engineering/lossless-clawScore 25/100 @martian-engineering/lossless-clawScore 25/100 openclaw-dashboard-repoScore 25/100

Scanned on April 14, 2026. stealth-browser is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan