ClawHub
Back to skill

Security audit

Agent Reach

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its web-research purpose, but it asks agents to use broad external scraping, account cookies, mutable setup instructions, and some write-capable social actions without enough user-control boundaries.

Install only if you are comfortable with a broad web/social automation skill that can send searches and URLs to SkillBoss, use local platform tools, and handle logged-in sessions. Do not let it use your default browser cookies or imported cookies unless you understand the account-access risk, and require explicit approval before posting, commenting, installing packages, fetching setup guides, configuring proxies, or sending private/internal URLs to external scrapers.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:99
Finding

Broad Browser Cookie Access for Bilibili Requests

Content
View full analysis
Server IPs may get 412. Use `--cookies-from-browser chrome` or configure proxy. ``` ### Technical Analysis The documented `--cookies-from-browser chrome` option directs `yt-dlp` to access Chrome's cookie database. This credential store can contain authenticated sessions for many unrelated domains, while the immediate operation only requires credentials applicable to Bilibili. The instruction therefore crosses a least-privilege boundary: instead of supplying narrowly scoped Bilibili credentials, the invoked tool is granted access to a general-purpose browser profile. Although `yt-dlp` normally filters cookies according to the requested URL, it must still access and process the browser cookie store. A compromised, replaced, or vulnerable executable could misuse that access. No evidence indicates that the Skill itself intentionally exfiltrates browser cookies. The risk arises from granting a third-party local tool access to credentials beyond the minimum scope needed for the requested task. ### Attack Path 1. A user requests content from Bilibili. 2. The request fails because the server IP receives an HTTP 412 response. 3. Following the Skill instructions, the Agent invokes `yt-dlp` with `--cookies-from-browser chrome`. 4. The process obtains access to the user's Chrome cookie database. 5. If the executable or one of its dependencies is compromised, it can read or misuse session credentials unrelated to Bilibili. 6. The exposed sessions could then be used to access other authenticated services as the user. ### Impact Assessment Successful exploitation could expose browser session cookies for services beyond the requested platform. Depending on the available cookies and service-side protections, this could enable unauthorized account access, session impersonation, or ...[truncated 254 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:198
Finding

Unpinned Global npm Package Installation

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:201
Finding

Mutable Remote Setup Instructions Can Change After Review

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger list contains very broad everyday phrases like 'research', 'find information', and '帮我查', which can cause the skill to auto-invoke in many unrelated contexts. Because this skill can reach external services, scrape content, and potentially interact with accounts, unintended invocation increases the chance of accidental data transmission or external actions without clear user intent.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
89% confidence
Finding

The recommendation to use '--cookies-from-browser chrome' instructs extraction and reuse of browser authentication state. In a general-purpose agent skill, this is dangerous because it normalizes access to browser-stored credentials and can lead to unauthorized account use, excessive privilege, or leakage of sensitive session data.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

L" # download subtitles, then read the .vtt file yt-dlp --dump-json "ytsearch5:query" # search

text

## Bilibili (yt-dlp)

```bash
yt-dlp --dump-json "https://www.bilibili.com/video/BVxxx"
yt-dlp --write-sub --write-auto-sub --sub-lang "zh-Hans,zh,en" --convert-subs vtt --skip-download -o "/tmp/%(id)s" "URL"

Server IPs may get 412. Use --cookies-from-browser chrome or configure proxy.

Reddit

bash
curl -s "https://www.reddit.com/r/SUBREDDIT/hot.json?limit=10" -H "User-Agent: agent-reach/1.0"
curl -s "https://www.reddit.com/search.json?q=QUERY&limit=10" -H "User-Agent: agent-reach/1.0"

Server IPs may get 403. Search via SkillBoss API Hub instead, or configure proxy.

GitHub (gh CLI)

bash
gh search repos "query" --sort stars --limit 10
gh repo view owner/repo
gh search code "query" --language python
gh issue list -R owner/repo --state open
gh issue view 123 -R owner/repo

小红书 / XiaoHongShu (mcp

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description says the skill should be used when the user asks to 'post, comment, or interact on supported platforms' but does not prominently warn that this may modify third-party accounts or publish external content. In an agent setting, this can lead to real-world side effects if the skill is invoked without an explicit confirmation boundary for write actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
## ⚠️ Workspace Rules

**Never create files in the agent workspace.** Use `/tmp/` for temporary output and `~/.agent-reach/` for persistent data.

## Web — Any URL

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This code sends user-supplied URLs and an API bearer token to a third-party service for scraping. External transmission is expected for a web-reach skill, but it is still security-relevant because arbitrary URLs, potentially sensitive targets, and access metadata are disclosed to an external provider.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "URL"}},

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This code sends user-supplied URLs and an API bearer token to a third-party service for scraping. External transmission is expected for a web-reach skill, but it is still security-relevant because arbitrary URLs, potentially sensitive targets, and access metadata are disclosed to an external provider.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "URL"}},

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The explicit external API endpoint confirms that arbitrary scraping requests are routed to a remote service. In this skill context, that is intended, but it remains a real privacy and data-governance concern because user requests and targets leave the local environment.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "URL"}},
    timeout=60,

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The search example transmits user queries and an API credential to an external service. While this is core functionality, search queries can contain sensitive business, personal, or investigative information, so silent forwarding to a third party creates privacy and confidentiality risk.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "search", "inputs": {"query": "query"}, "prefer": "balanced"},

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The search example transmits user queries and an API credential to an external service. While this is core functionality, search queries can contain sensitive business, personal, or investigative information, so silent forwarding to a third party creates privacy and confidentiality risk.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "search", "inputs": {"query": "query"}, "prefer": "balanced"},

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The external search endpoint means user research queries are processed by a third party. This is not malicious by itself, but in an enterprise or agent environment it can leak confidential intent, topics, or identifiers through normal usage.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "search", "inputs": {"query": "query"}, "prefer": "balanced"},
    timeout=60,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The instruction to import cookies for login-capable platform access encourages handling sensitive authentication material without a clear user-facing warning about secrecy, scope, and risk. Browser cookies can grant direct account access, so casual collection or pasting of them creates a significant account-takeover and privacy exposure risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The LinkedIn fallback scraping example sends a target profile URL to a third-party scraper service along with an authorization token. This is expected behavior for the skill, but it extends data exposure to an external vendor and may implicate profile lookups or proprietary research targets.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "https://linkedin.com/in/username"}},

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The LinkedIn fallback scraping example sends a target profile URL to a third-party scraper service along with an authorization token. This is expected behavior for the skill, but it extends data exposure to an external vendor and may implicate profile lookups or proprietary research targets.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "https://linkedin.com/in/username"}},

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This endpoint use in the LinkedIn fallback similarly discloses requested URLs and token-authenticated calls to a remote provider. The danger is contextual rather than inherently malicious: the skill expands the trust boundary to an external scraping service.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "https://linkedin.com/in/username"}},
    timeout=60,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The yt-dlp example hard-codes subtitle language selection as "zh-Hans,zh,en", prioritizing Chinese locales without asking the user for language preference. This is a natural-language locale choice embedded in the skill guidance rather than an explicit user-selected option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The Bilibili subtitle example also hard-codes "zh-Hans,zh,en" as the subtitle language order, imposing a locale preference without explicit user choice. The file does not document this as a justified region-specific constraint or offer an opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.