ClawHub
Back to skill

Security audit

Crawl

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Tavily-powered website crawler, with privacy and local-file-retention considerations users should understand before use.

Install only if you are comfortable sending crawl targets, filters, instructions, and retrieved content to Tavily. Use it for public or approved websites, keep the Tavily API key out of shared files and repositories, and choose an output directory where saved markdown archives can be reviewed and deleted when no longer needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The skill instructs users to modify ~/.claude/settings.json, which is a sensitive agent configuration location. Guidance that touches config directories is higher risk because mistakes can expose API keys broadly, alter agent behavior globally, or encourage unsafe secret handling in a shared environment.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Tavily API Key Required - Get your key at https://tavily.com

Add to ~/.claude/settings.json:

json
{
  "env": {

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents shell-based execution (./scripts/crawl.sh, curl) but does not declare any permissions or allowed-tools scope. This can lead to overbroad agent execution authority and makes it harder to enforce least privilege when the skill is invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description says 'Crawl any website' and promotes broad offline access/analysis use, which is permissive activation language that may cause the skill to trigger in situations where users did not explicitly intend third-party crawling or local archival. In an agent setting, unintended invocation increases the chance of surprise network access, data transfer, and local file creation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description omits a user-facing warning that crawling sends requested URLs and retrieved content to Tavily, a third-party API. That creates a data disclosure risk if users provide internal, sensitive, or regulated targets under the assumption the action is purely local.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This example performs an authenticated POST to Tavily's external crawl API, transmitting at minimum the target URL and potentially other crawl parameters to a third party. In the context of a crawler skill, this is expected functionality, but it is still dangerous if used on confidential targets or with sensitive instructions because the transmission boundary is external.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

Basic Crawl

bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This focused crawl example transmits target URLs, regex path filters, and instructions to Tavily's external service. While normal for the feature, it can expose internal site structure and sensitive research intent if users apply it to non-public systems.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This example sends crawl requests and semantic instructions to Tavily for agentic research, which means both the target and user-provided guidance are disclosed externally. The chunking feature reduces context size but does not reduce the privacy risk of third-party processing.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

Use when feeding crawl results into an LLM context:

bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The targeted technical docs example sends crawl targets and subject-matter instructions such as authentication/security topics to Tavily. In some organizations, even the fact that a team is researching certain security areas can be sensitive metadata, making external disclosure more risky in context.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The full-page archive example can cause a large amount of externally retrieved content to be processed and then saved locally, compounding privacy and retention risk. This is more dangerous in context because it combines third-party transmission with creation of a persistent local archive.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

bash
curl --request POST \
  --url https://api.tavily.com/crawl \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The map example transmits the target URL and instructions to Tavily's external API, disclosing browsing targets and potentially internal structure even though it returns only URLs. It is somewhat less risky than full crawl because content is not fetched into results, but the third-party disclosure remains real.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

bash
curl --request POST \
  --url https://api.tavily.com/map \
  --header "Authorization: Bearer $TAVILY_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crawl.sh (reported line 67)May include surrounding context.

sh
URL=$(echo "$JSON_INPUT" | jq -r '.url')
echo "Crawling: $URL"

RESPONSE=$(curl -s --request POST \
    --url https://api.tavily.com/crawl \
    --header "Authorization: Bearer $TAVILY_API_KEY" \
    --header 'Content-Type: application/json' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
echo "Crawling: $URL"

RESPONSE=$(curl -s --request POST \
    --url https://api.tavily.com/crawl \
    --header "Authorization: Bearer $TAVILY_API_KEY" \
    --header 'Content-Type: application/json' \
    --header 'x-client-source: claude-code-skill' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
echo "Crawling: $URL"

RESPONSE=$(curl -s --request POST \
    --url https://api.tavily.com/crawl \
    --header "Authorization: Bearer $TAVILY_API_KEY" \
    --header 'Content-Type: application/json' \
    --header 'x-client-source: claude-code-skill' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md
echo "Crawling: $URL"

RESPONSE=$(curl -s --request POST \
    --url https://api.tavily.com/crawl \
    --header "Authorization: Bearer $TAVILY_API_KEY" \
    --header 'Content-Type: application/json' \
    --header 'x-client-source: claude-code-skill' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crawl.sh (reported line 68)May include surrounding context.

sh
echo "Crawling: $URL"

RESPONSE=$(curl -s --request POST \
    --url https://api.tavily.com/crawl \
    --header "Authorization: Bearer $TAVILY_API_KEY" \
    --header 'Content-Type: application/json' \
    --header 'x-client-source: claude-code-skill' \

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The instructions mention saving crawled pages to an output_dir as local markdown files but do not warn users that the workflow creates potentially large local artifacts. This can surprise users, overwrite or clutter directories, and persist sensitive data on disk longer than intended.

Content

No source excerpt is available for this finding.