ClawHub
Back to skill

Security audit

Crawl

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Tavily-powered website crawler, with privacy and local-file-retention considerations users should understand before use.

Install only if you are comfortable sending crawl targets, filters, instructions, and retrieved content to Tavily. Use it for public or approved websites, keep the Tavily API key out of shared files and repositories, and choose an output directory where saved markdown archives can be reviewed and deleted when no longer needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)

Agent Config Directory Access

High
Category
Agent Snooping
Content
**Tavily API Key Required** - Get your key at https://tavily.com

Add to `~/.claude/settings.json`:
```json
{
  "env": {
Confidence
90% confidence
Finding
The skill instructs users to modify `~/.claude/settings.json`, which is a sensitive agent configuration location. Guidance that touches config directories is higher risk because mistakes can expose API keys broadly, alter agent behavior globally, or encourage unsafe secret handling in a shared environment.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documents shell-based execution (`./scripts/crawl.sh`, `curl`) but does not declare any `permissions` or `allowed-tools` scope. This can lead to overbroad agent execution authority and makes it harder to enforce least privilege when the skill is invoked.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The description says 'Crawl any website' and promotes broad offline access/analysis use, which is permissive activation language that may cause the skill to trigger in situations where users did not explicitly intend third-party crawling or local archival. In an agent setting, unintended invocation increases the chance of surprise network access, data transfer, and local file creation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The description omits a user-facing warning that crawling sends requested URLs and retrieved content to Tavily, a third-party API. That creates a data disclosure risk if users provide internal, sensitive, or regulated targets under the assumption the action is purely local.

External Transmission

Medium
Category
Data Exfiltration
Content
### Basic Crawl

```bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
Confidence
97% confidence
Finding
This example performs an authenticated POST to Tavily's external crawl API, transmitting at minimum the target URL and potentially other crawl parameters to a third party. In the context of a crawler skill, this is expected functionality, but it is still dangerous if used on confidential targets or with sensitive instructions because the transmission boundary is external.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
Confidence
96% confidence
Finding
This focused crawl example transmits target URLs, regex path filters, and instructions to Tavily's external service. While normal for the feature, it can expose internal site structure and sensitive research intent if users apply it to non-public systems.

External Transmission

Medium
Category
Data Exfiltration
Content
Use when feeding crawl results into an LLM context:

```bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
Confidence
97% confidence
Finding
This example sends crawl requests and semantic instructions to Tavily for agentic research, which means both the target and user-provided guidance are disclosed externally. The chunking feature reduces context size but does not reduce the privacy risk of third-party processing.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
Confidence
96% confidence
Finding
The targeted technical docs example sends crawl targets and subject-matter instructions such as authentication/security topics to Tavily. In some organizations, even the fact that a team is researching certain security areas can be sensitive metadata, making external disclosure more risky in context.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
Confidence
96% confidence
Finding
The full-page archive example can cause a large amount of externally retrieved content to be processed and then saved locally, compounding privacy and retention risk. This is more dangerous in context because it combines third-party transmission with creation of a persistent local archive.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --request POST \
  --url https://api.tavily.com/map \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
Confidence
95% confidence
Finding
The map example transmits the target URL and instructions to Tavily's external API, disclosing browsing targets and potentially internal structure even though it returns only URLs. It is somewhat less risky than full crawl because content is not fetched into results, but the third-party disclosure remains real.

External Transmission

Medium
Category
Data Exfiltration
Content
URL=$(echo "$JSON_INPUT" | jq -r '.url')
echo "Crawling: $URL"

RESPONSE=$(curl -s --request POST \
    --url https://api.tavily.com/crawl \
    --header "Authorization: Bearer $TAVILY_API_KEY" \
    --header 'Content-Type: application/json' \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
echo "Crawling: $URL"

RESPONSE=$(curl -s --request POST \
    --url https://api.tavily.com/crawl \
    --header "Authorization: Bearer $TAVILY_API_KEY" \
    --header 'Content-Type: application/json' \
    --header 'x-client-source: claude-code-skill' \
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
echo "Crawling: $URL"

RESPONSE=$(curl -s --request POST \
    --url https://api.tavily.com/crawl \
    --header "Authorization: Bearer $TAVILY_API_KEY" \
    --header 'Content-Type: application/json' \
    --header 'x-client-source: claude-code-skill' \
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
echo "Crawling: $URL"

RESPONSE=$(curl -s --request POST \
    --url https://api.tavily.com/crawl \
    --header "Authorization: Bearer $TAVILY_API_KEY" \
    --header 'Content-Type: application/json' \
    --header 'x-client-source: claude-code-skill' \
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
echo "Crawling: $URL"

RESPONSE=$(curl -s --request POST \
    --url https://api.tavily.com/crawl \
    --header "Authorization: Bearer $TAVILY_API_KEY" \
    --header 'Content-Type: application/json' \
    --header 'x-client-source: claude-code-skill' \
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The instructions mention saving crawled pages to an `output_dir` as local markdown files but do not warn users that the workflow creates potentially large local artifacts. This can surprise users, overwrite or clutter directories, and persist sensitive data on disk longer than intended.