ClawHub
Back to skill

Security audit

Web Extract

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed ZooData web-extraction client, with expected third-party API use and credential handling for its stated purpose.

Install only if you are comfortable sending target URLs, search queries, interaction steps, and scraped page content to ZooData. Prefer an environment variable or protected config file for the API key, avoid submitting secrets or internal-only URLs, and note that the check command consumes one credit.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill clearly uses sensitive capabilities—environment-variable access for API keys, local file reads for config files, and outbound network access to a third-party service—yet it does not declare corresponding permissions in a machine-readable way beyond custom metadata. This creates a transparency and governance gap: users or hosting systems may not realize the skill can read credentials and transmit user-supplied data externally.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation explains how to send URLs, search queries, and interactive browser actions to ZooData, but it does not prominently warn that these user-provided inputs are transmitted to an external third-party API. This can lead to unintended disclosure of sensitive URLs, internal targets, search terms, or interaction scripts if a user assumes processing is local.

External Transmission

Medium
Category
Data Exfiltration
Content
Run `$WT <subcommand> --help` for every flag on any subcommand.

## Same calls via raw curl

When the CLI isn't available (no `python3` / offline / restricted env), every endpoint also takes a plain JSON POST:
Confidence
92% confidence
Finding
curl When the CLI isn't available (no `python3` / offline / restricted env), every endpoint also takes a plain JSON POST: ```bash curl -sS -X POST https://api.zoodata.ai/openapi/v2/webtools/scrape \

External Transmission

Medium
Category
Data Exfiltration
Content
1. **`webtools.py` CLI** (preferred — quirks baked in): UA header, warmup tolerance, retry/backoff, JSON-first defaults all handled. Just run `python {skill_base_dir}/scripts/webtools.py <subcommand>`.
2. **Raw curl / HTTP** (when CLI isn't installed or for ad-hoc calls): every example below also shows the raw POST. **Always set `User-Agent: web-extract-skill/1.0`** — the Cloudflare edge rejects the default Python-urllib UA with HTTP 403 (see Tips).

Endpoint base URL: `https://api.zoodata.ai/openapi/v2/webtools/*`. All POST with JSON body, except `crawl/{id}` (GET).

## Default format: JSON
Confidence
93% confidence
Finding
https://api.zoodata.ai/

Session Persistence

Medium
Category
Rogue Agent
Content
- **Get a free key** (1,000 credits, no credit card): https://zoodata.ai/en/api-keys
   - **Configure** via one of:
     - `export ZOODATA_API_KEY='hms_live_xxx'` (session only)
     - `mkdir -p ~/.zoodata && echo '{"api_key":"hms_live_xxx"}' > ~/.zoodata/config.json` (persistent)

## On 401 Invalid Key
Confidence
84% confidence
Finding
mkdir -p ~/.zoodata && echo '{"api_key":"hms_live_xxx"}' > ~/.zoodata

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.