ClawHub
Back to skill

Security audit

web-extract

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed ZooData web extraction wrapper that sends user-requested URLs and queries to ZooData's API and uses an API key, with no hidden execution or unrelated data access found.

Install only if you are comfortable sending requested URLs, search queries, crawl options, and the ZooData API key to ZooData. Prefer an environment variable for the key when possible, keep any ~/.zoodata/config.json file private, and confirm cost and scope before broad crawls or deep-scraped searches.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill exercises sensitive capabilities—reading environment variables, reading a credential file from the user's home directory, and transmitting user-supplied URLs/queries plus credentials to an external API—but does not declare equivalent permissions in a visible permission model. That under-specification weakens user consent and security review because consumers may not realize the skill can access local secrets and perform outbound network actions.

External Transmission

Medium
Category
Data Exfiltration
Content
Run `$WT <subcommand> --help` for every flag on any subcommand.

## Same calls via raw curl

When the CLI isn't available (no `python3` / offline / restricted env), every endpoint also takes a plain JSON POST:
Confidence
88% confidence
Finding
The curl example instructs sending Authorization bearer credentials and target content requests to a third-party service. External transmission is the core function of the skill, but it is still security-relevant because user-provided URLs, search queries, and possibly sensitive internal targets could be exfiltrated to the vendor if used without restriction.

External Transmission

Medium
Category
Data Exfiltration
Content
1. **`webtools.py` CLI** (preferred — quirks baked in): UA header, warmup tolerance, retry/backoff, JSON-first defaults all handled. Just run `python {skill_base_dir}/scripts/webtools.py <subcommand>`.
2. **Raw curl / HTTP** (when CLI isn't installed or for ad-hoc calls): every example below also shows the raw POST. **Always set `User-Agent: web-extract-skill/1.0`** — the Cloudflare edge rejects the default Python-urllib UA with HTTP 403 (see Tips).

Endpoint base URL: `https://api.zoodata.ai/openapi/v2/webtools/*`. All POST with JSON body, except `crawl/{id}` (GET).

## Default format: JSON
Confidence
91% confidence
Finding
The skill explicitly defines an external network data flow to api.zoodata.ai and states that target pages are fetched server-side by the provider. In context this is expected behavior, but it remains a real data-transfer risk because the skill can relay sensitive prompts, URLs, and page contents outside the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
Full request/response schemas for every endpoint under `/openapi/v2/webtools/*`.
Load this file when you need exact field names, error codes, billing rules, or response shapes — the SKILL.md is the day-to-day cheat sheet, this is the source of truth.

**Base URL**: `https://api.zoodata.ai/openapi/v2/webtools`
**Auth**: `Authorization: Bearer hms_live_xxx`
**Content-Type**: `application/json` (all POSTs)
Confidence
89% confidence
Finding
This skill is explicitly designed to transmit user-supplied URLs, queries, and potentially extracted page content to an external third-party service at api.zoodata.ai. In the context of an agent skill, that creates a real data-exfiltration/privacy risk if users provide sensitive URLs, internal endpoints, credentials, or proprietary content without clear consent and handling constraints.

Session Persistence

Medium
Category
Rogue Agent
Content
- **Get a free key** (1,000 credits, no credit card): https://zoodata.ai/en/api-keys
   - **Configure** via one of:
     - `export ZOODATA_API_KEY='hms_live_xxx'` (session only)
     - `mkdir -p ~/.zoodata && chmod 700 ~/.zoodata && (umask 077; echo '{"api_key":"hms_live_xxx"}' > ~/.zoodata/config.json)` (persistent; keep the file private — 0600)

## On 401 Invalid Key
Confidence
86% confidence
Finding
The skill recommends persisting a bearer API key in ~/.zoodata/config.json. Although file permissions are restricted, storing long-lived credentials on disk increases exposure to compromise from other local processes, backups, endpoint theft, or accidental inclusion in support bundles; the skill context makes this somewhat less dangerous because it at least prescribes 0600-style protections.

Static analysis

No suspicious patterns detected.