T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/webclaw.py:270- Finding
DNS Rebinding Can Bypass the Local SSRF Protection
- Content
View full analysis
- Remediation
View remediation
Security audit
webclaw
Security checks for vulnerabilities and agentic risk
Overview
This web-extraction skill is mostly transparent about using a remote API, but its broad default-use guidance, backend-discovery and bypass-oriented examples, unpinned install path, remote monitors, and local-fetch SSRF weakness warrant Review before installation.
Install only if you are comfortable sending target URLs, page contents, research prompts, and monitor/webhook details to WebClaw's remote service. Avoid using it for private networks, confidential documents, regulated data, or third-party security probing unless you have explicit authorization, and prefer a pinned install source for the MCP component.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (45)
Tainted flow: 'req' from os.environ.get (line 229, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python raw API error string is surfaced when the server returns one. """ try: with urllib.request.urlopen(req, timeout=120) as resp: raw = resp.read() except urllib.error.HTTPError as e: body_text = e.read().decode("utf-8", errors="replace")
Ssd 2
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The research example asks for 'known bypass methods' for Cloudflare Turnstile, directly soliciting assistance to defeat a protection mechanism. Even as an example, this normalizes and operationalizes harmful security-evasion research within the skill documentation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill exposes network access and use of an environment secret (
WEBCLAW_API_KEY) but does not declare a restrictive tool scope such as allowed tools or permissions. That makes it easier for an agent to invoke remote operations and handle secrets without clear policy boundaries, increasing the chance of unintended exfiltration or misuse.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
Referencing an MCP server install via
npx create-webclawwithout a pinned version creates a supply-chain risk: future upstream changes or a compromised package version could alter installed behavior unexpectedly. Because this is an execution/install path for agent tooling, unpinned dependencies materially weaken integrity guarantees.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guidance says to use the skill 'Always' for web content, encouraging routine delegation of ordinary fetches to a third-party remote service. This broad default increases unnecessary exposure of user queries, URLs, and retrieved content, and can bypass safer built-in or more transparent local mechanisms.
- Content
Ssd 2
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill advertises capabilities to handle pages that block bots and to discover JavaScript-called API endpoints, which frames the tool toward bypass and reconnaissance workflows. In agent contexts, that can steer automated behavior toward interacting with defenses and mapping backend surfaces beyond ordinary content retrieval.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 98% confidence
- Finding
The API base section establishes that all requests are sent to
https://api.webclaw.io/v1/, making remote transmission a core behavior of the skill. This is not malicious, but it is a true security-relevant data flow that should be disclosed prominently because users may provide sensitive URLs or content.- Content
md ## API base All requests go to `https://api.webclaw.io/v1/`. Authentication: `Authorization: Bearer $WEBCLAW_API_KEY`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill prominently directs all requests to a remote API authenticated with a bearer token, but the primary usage guidance lacks a nearby privacy warning that user-supplied URLs, page contents, and possibly extracted data are transmitted off-box. This can lead to silent disclosure of sensitive browsing targets or proprietary content to a third party.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
This example demonstrates sending user-provided URLs to an external API service, which is a real data-transmission behavior. While expected for a SaaS scraping skill, it is still security-relevant because target URLs and returned content may be sensitive and are disclosed to a third party.
- Content
Example vertical call:
bash curl -X POST https://api.webclaw.io/v1/scrape/reddit \ -H "Authorization: Bearer $WEBCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url":"https://www.reddit.com/r/rust/comments/abc/title/"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
This example demonstrates sending user-provided URLs to an external API service, which is a real data-transmission behavior. While expected for a SaaS scraping skill, it is still security-relevant because target URLs and returned content may be sensitive and are disclosed to a third party.
- Content
Example vertical call:
bash curl -X POST https://api.webclaw.io/v1/scrape/reddit \ -H "Authorization: Bearer $WEBCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url":"https://www.reddit.com/r/rust/comments/abc/title/"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This call sends a YouTube URL to a remote service and returns enriched metadata and transcript, confirming off-platform transmission and processing of user-requested content. The risk is privacy and data-governance related, especially if users assume fetches are local or first-party.
- Content
youtube(object) —{ video_id, title, description, channel, channel_url, uploader, upload_date, duration_seconds, view_count, like_count, thumbnail, tags, categories, language }.
bash curl -X POST https://api.webclaw.io/v1/scrape \ -H "Authorization: Bearer $WEBCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "https://www.youtube.com/watch?v=dQw4w9WgXcQ"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This call sends a YouTube URL to a remote service and returns enriched metadata and transcript, confirming off-platform transmission and processing of user-requested content. The risk is privacy and data-governance related, especially if users assume fetches are local or first-party.
- Content
youtube(object) —{ video_id, title, description, channel, channel_url, uploader, upload_date, duration_seconds, view_count, like_count, thumbnail, tags, categories, language }.
bash curl -X POST https://api.webclaw.io/v1/scrape \ -H "Authorization: Bearer $WEBCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "https://www.youtube.com/watch?v=dQw4w9WgXcQ"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The map endpoint sends a site URL to an external service for URL discovery, which is a genuine external transmission of user intent and target information. In some environments, even revealing which domains a user is analyzing can be sensitive.
- Content
Fast URL discovery without full content extraction.
bash curl -X POST https://api.webclaw.io/v1/map \ -H "Authorization: Bearer $WEBCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "https://example.com"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The map endpoint sends a site URL to an external service for URL discovery, which is a genuine external transmission of user intent and target information. In some environments, even revealing which domains a user is analyzing can be sensitive.
- Content
Fast URL discovery without full content extraction.
bash curl -X POST https://api.webclaw.io/v1/map \ -H "Authorization: Bearer $WEBCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "https://example.com"}'
Ssd 2
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The endpoint-discovery section explicitly describes scanning scripts to surface API, GraphQL, and WebSocket endpoints and calls it useful for reverse-engineering a site's backend. That materially increases dual-use risk by giving agents a reconnaissance primitive that can aid unauthorized mapping of application attack surfaces.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md "endpoint_count": 23, "endpoints": [ { "value": "/api/v1/users", "kind": "relative_path", "first_party": true, "source": "inline" }, { "value": "https://api.example.com/graphql", "kind": "absolute_url", "first_party": true, "source": "https://example.com/static/app.4f2c.js" }, { "value": "query { viewer { id } }", "kind": "graph_ql", "first_party": true, "source": "https://example.com/static/app.4f2c.js" }, { "value": "wss://realtime.example.com/socket", "kind": "web_socket", "first_party": true, "source": "inline" } ],
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
Batch scraping amplifies the same external-transmission risk by sending multiple URLs and receiving page content via a third-party API. Because it operates in parallel and at scale, the privacy and data-loss surface is larger than a single fetch.
- Content
5. Batch — scrape multiple URLs in parallel
bash curl -X POST https://api.webclaw.io/v1/batch \ -H "Authorization: Bearer $WEBCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
Batch scraping amplifies the same external-transmission risk by sending multiple URLs and receiving page content via a third-party API. Because it operates in parallel and at scale, the privacy and data-loss surface is larger than a single fetch.
- Content
5. Batch — scrape multiple URLs in parallel
bash curl -X POST https://api.webclaw.io/v1/batch \ -H "Authorization: Bearer $WEBCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The research endpoint sends an entire research query to a remote service, which may include sensitive objectives, investigative topics, or internal questions. This is a real confidentiality concern, especially given the example's security-focused content.
- Content
Start research:
bash curl -X POST https://api.webclaw.io/v1/research \ -H "Authorization: Bearer $WEBCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The research endpoint sends an entire research query to a remote service, which may include sensitive objectives, investigative topics, or internal questions. This is a real confidentiality concern, especially given the example's security-focused content.
- Content
Start research:
bash curl -X POST https://api.webclaw.io/v1/research \ -H "Authorization: Bearer $WEBCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
Polling the research result endpoint continues the remote processing workflow and may retrieve synthesized content based on sensitive queries. This reinforces that the skill's operation is not local and may persist or expose analytical outputs externally.
- Content
Poll results:
bash curl https://api.webclaw.io/v1/research/res-abc-123 \ -H "Authorization: Bearer $WEBCLAW_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
Polling the research result endpoint continues the remote processing workflow and may retrieve synthesized content based on sensitive queries. This reinforces that the skill's operation is not local and may persist or expose analytical outputs externally.
- Content
Poll results:
bash curl https://api.webclaw.io/v1/research/res-abc-123 \ -H "Authorization: Bearer $WEBCLAW_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The compatibility layer still routes scraping requests to the same external service, so it preserves the same privacy and exfiltration concerns while potentially obscuring that users are using a third-party backend under a compatibility path. That can make data-flow understanding worse, not better.
- Content
| POST |
/v2/search| web search |bash curl -X POST https://api.webclaw.io/v2/scrape \ -H "Authorization: Bearer $WEBCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "https://example.com", "formats": ["markdown"]}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The compatibility layer still routes scraping requests to the same external service, so it preserves the same privacy and exfiltration concerns while potentially obscuring that users are using a third-party backend under a compatibility path. That can make data-flow understanding worse, not better.
- Content
| POST |
/v2/search| web search |bash curl -X POST https://api.webclaw.io/v2/scrape \ -H "Authorization: Bearer $WEBCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "https://example.com", "formats": ["markdown"]}'
Ssd 2
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The tips section explicitly recommends using endpoint discovery to reverse-engineer a site's backend, reinforcing offensive reconnaissance behavior as a best practice. This increases the likelihood that downstream agents interpret the feature as intended for unauthorized target analysis rather than narrow legitimate use.
- Content
Static analysis
No suspicious patterns detected.