ClawHub
Back to skill

Security audit

Fetch

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent public web-fetching tool, but its URL checks do not enforce the advertised public-only boundary and could fetch internal or local network URLs from the agent host.

Review before installing. Use this only for clearly public HTTP/HTTPS pages, not localhost, private-network hosts, cloud metadata addresses, or URLs controlled by untrusted parties that might redirect internally. The main fix should be strict public-destination validation and redirect validation before this is treated as a low-risk fetch utility.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/fetch_url.py:22
Finding

Server-Side Request Forgery Through Insufficient URL Validation

Content
View full analysis

Vulnerability Details

File Location: scripts/fetch_url.py:22-32
Vulnerability Type: Server-Side Request Forgery (SSRF) / unrestricted private-network access
Risk Level: High

Vulnerable Code

python
parsed = urlparse(args.url)
if parsed.scheme not in ("http", "https"):
    print("Only http/https URLs are allowed.")
    sys.exit(1)

req = Request(
    args.url,
    headers={"User-Agent": "Mozilla/5.0 (compatible; FetchSkill/1.0.0)"}
)

with urlopen(req, timeout=20) as resp:

Technical Analysis

The URL validation only verifies that the supplied scheme is HTTP or HTTPS. It does not verify that the destination is genuinely public, despite the public-only security boundary documented by the skill.

The implementation does not reject:

  • Loopback destinations such as 127.0.0.1 or ::1
  • RFC1918 private IPv4 networks
  • IPv6 unique-local addresses
  • Link-local and cloud metadata addresses
  • Reserved, unspecified, multicast, or otherwise non-public addresses
  • Public hostnames that resolve to non-public IP addresses
  • Redirects from an initially public URL to a prohibited destination
  • DNS-rebinding scenarios
  • URLs containing embedded user-information components

urlopen() performs the request from the agent host and follows HTTP redirects. An attacker who controls the --url value can therefore direct the skill to HTTP services that are inaccessible from the attacker's own network position.

The fetched response is read and subsequently written to local raw and cleaned output files. Job metadata records the source URL and output locations, allowing the retrieved information to be accessed through the skill's normal workflow.

Attack Path

  1. The attacker identifies or guesses an internal HTTP endpoint reachable from the agent host.
  2. The attacker supplies a URL targeting a loopback, private-network, link-local, or metadata address. Alternatively, the attacker su ...[truncated 1329 chars]
Remediation
View remediation

Remediation Suggestions

Implement centralized URL validation and controlled redirect handling:

  1. Permit only explicitly supported schemes, normally HTTP and HTTPS.
  2. Reject URLs containing embedded credentials or malformed host components.
  3. Resolve the hostname before connecting and inspect every resulting IPv4 and IPv6 address.
  4. Reject loopback, private, link-local, multicast, unspecified, reserved, unique-local, and other non-global address ranges.
  5. Explicitly block cloud metadata destinations and deployment-specific internal ranges.
  6. Disable automatic redirects or validate every redirect target using the same policy before following it.
  7. Mitigate DNS rebinding and time-of-check/time-of-use issues by ensuring the connection is made to a previously validated address while preserving correct HTTP Host and TLS SNI behavior.
  8. Prefer an outbound proxy or egress firewall that independently enforces public-destination restrictions.
  9. Where practical, use an explicit hostname allowlist rather than attempting to deny every sensitive destination.
  10. Add tests covering IPv4, IPv6, alternate address representations, internal DNS results, redirect chains, and DNS-rebinding behavior.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares capabilities to fetch URLs and store data locally, which implies network access plus file read/write behavior, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity: the runtime may permit broader access than reviewers or policy systems can easily verify, increasing the risk of unintended network retrieval or filesystem writes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description is broad enough that the skill could be selected for generic requests like 'inspect', 'save content', or 'download', even when the user did not clearly intend public web retrieval. In a skill with network and local storage behavior, over-broad routing increases the chance of unnecessary external requests or writing retrieved content locally in contexts where a narrower skill should have been used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

This code writes JSON data to a persistent file under the user's home directory using a temporary file and atomic replace, but it does not include any confirmation prompt, log message, print statement, or explanatory comment/docstring disclosing that behavior. Because this is a code file, persistent file writes should have some visible warning unless clearly documented elsewhere or inherently obvious from the skill context, which is not evident in this file alone.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.