ClawHub
Back to skill

Security audit

Crawl

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Tavily-powered website crawler, but users should avoid using it on private or sensitive sites.

Install only if you are comfortable sending crawl targets, path filters, semantic instructions, and crawl activity to Tavily. Use it for public or approved content, avoid secrets in URLs and internal/authenticated sites, choose a controlled output directory, and consider using a scoped or disposable Tavily API key.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs users to run a shell script and curl commands but does not declare corresponding permissions or execution capabilities. This creates a transparency and policy gap: an agent or user may invoke networked shell behavior without an explicit permission boundary, increasing the chance of unintended external requests and local file writes.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest describes local website crawling and saving, but the implementation sends the requested crawl job and user-supplied parameters to Tavily's remote API. This mismatch can cause users to unintentionally transmit sensitive target URLs, filtering instructions, or access patterns to a third party under the assumption that crawling happens locally.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation phrasing is broad enough to match many normal user requests involving documentation, websites, or offline analysis. Over-broad triggering can cause the agent to invoke this skill in situations where the user did not intend external crawling or local saving, leading to unnecessary data disclosure to Tavily and unexpected file creation.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill does not warn users that submitted URLs and retrieved page content are sent to Tavily, a third-party external API, and that content may be written to local markdown files. This is dangerous because users may unknowingly expose sensitive internal URLs, private documentation, query parameters, or regulated content to an external service and persist copies locally.

External Transmission

Medium
Category
Data Exfiltration
Content
URL=$(echo "$JSON_INPUT" | jq -r '.url')
echo "Crawling: $URL"

RESPONSE=$(curl -s --request POST \
    --url https://api.tavily.com/crawl \
    --header "Authorization: Bearer $TAVILY_API_KEY" \
    --header 'Content-Type: application/json' \
Confidence
96% confidence
Finding
curl -s --request POST \ --url https://api.tavily.com/crawl \ --header "Authorization: Bearer $TAVILY_API_KEY" \ --header 'Content-Type: application/json' \ --header 'x-client-source:

VirusTotal

No VirusTotal findings

View on VirusTotal