ClawHub
Back to skill

Security audit

Alvis Web Scrape

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed web-scraping guidance skill with a third-party managed scraping option, and I found no hidden code, persistence, or destructive behavior.

Install only if you are comfortable using SkillBoss for managed scraping and understand that scraping requests may expose target information and retrieved content to that service. Use a dedicated API key and role-based contact address, follow robots.txt and site terms, and do not scrape protected, personal, confidential, or regulated data without clear authorization.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

Unnecessary Disclosure of Contact Email to Scraped Websites

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:31
Vulnerability Type: Sensitive information exposure through outbound HTTP headers
Risk Level: Medium

Complete Snippet:

markdown
- **User-Agent**: Real browser string + contact email: `Mozilla/5.0 ... (contact: you@email.com)`

Technical Analysis

The Skill instructs the agent to include a contact email in the User-Agent header used for scraping. If the placeholder is replaced with the operator's personal or otherwise sensitive address, every contacted website receives that information.

The address can be retained in origin-server logs and exposed to reverse proxies, content-delivery networks, web application firewalls, monitoring systems, and analytics services. Because the same identifier may be sent to unrelated domains, recipients can also use it to correlate activity across scraping sessions.

Disclosing a personal address is not required for the declared scraping functionality. A non-identifying project name is sufficient in most cases, while operators who intentionally provide contact information can use a dedicated role-based address after explicit consent. The instruction therefore exceeds minimum data privileges.

Attack Path

  1. An agent follows the Skill's User-Agent guidance.
  2. The placeholder is replaced with the user's real contact email.
  3. The agent sends a scraping request to an unrelated or attacker-controlled website.
  4. The website and its infrastructure record the complete User-Agent header.
  5. The recipient extracts the email and uses it for spam, phishing, profiling, or correlation with requests to other websites.

Impact Assessment

This issue does not grant direct local-system privileges or access to the SkillBoss API credential. Its scope is disclosure of the supplied email to every contacted host and potentially to intermediaries processing their HTTP traffic.

The exposed address may enable targeted phis ...[truncated 222 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the recommendation to include a personal email in every User-Agent.
  • Default to a non-identifying project User-Agent, such as ProjectScraper/1.0.
  • If contact information is operationally necessary, require explicit user consent and recommend a dedicated role-based address that is not used for personal accounts.
  • Clearly warn that any supplied identifier will be disclosed to each destination host and may be stored by its infrastructure.
  • Allow contact details to be configured per approved domain rather than reused globally.
  • Apply data-minimization controls that prevent secrets, API keys, session tokens, and unrelated personal information from being inserted into outbound headers.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
- **Public data, no login** �?Generally legal (hiQ v. LinkedIn 2022)
- **Bypassing barriers** �?CFAA violation risk (Van Buren v. US 2021)
- **Ignoring robots.txt** �?Gray area, often breaches ToS (Meta v. Bright Data 2024)
- **Personal data without consent** �?GDPR/CCPA violation
- **Republishing copyrighted content** �?Copyright infringement

## Request Discipline

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill explicitly instructs use of an external endpoint, which creates an external transmission path for scraping targets and retrieved content. While this may be legitimate functionality, it is still security-relevant because users may unknowingly route potentially sensitive data or metadata to a third party.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
## SkillBoss API Hub Scraping

For managed content extraction with automatic anti-bot handling, use SkillBoss API Hub's scraping capability (`type: "scraper"`). Authenticate with `SkillBoss_API_KEY` and call `https://api.SkillBoss.co/v1/pilot`. Result is returned at `result.data.markdown`.

For code patterns, robots.txt parser, and SkillBoss API Hub scraping integration, see `code.md`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill directs users to send scraping requests through a third-party managed service authenticated with an API key, but it does not clearly disclose that target URLs, page contents, and related request metadata may be transmitted to and processed by an external provider. In a scraping context that may involve personal data or sensitive targets, this omission can cause unintentional data sharing and compliance failures.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.