ClawHub
Back to skill

Security audit

Recipe Video Extractor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward recipe extractor, with a manageable caution that it should only open ordinary public video URLs.

Install only if you are comfortable with the agent opening public recipe or video links in a browser/search flow. Avoid private, internal, local, file, or non-HTTPS URLs, and consider adding an explicit allowlist for supported video platforms if using it in a managed environment.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:10
Finding

Insufficient URL Validation Allows Arbitrary Browser Navigation

Content
View full analysis
`. 2. Validate URL format quickly. 3. Immediately acknowledge before extraction starts. ``` ```markdown 1. **Description/Caption first (highest signal)** - Open the URL in browser automation. ``` ### Technical Analysis The skill directs browser automation to open a user-controlled URL after only a vaguely defined, superficial URL-format check. It does not require an allowlist of supported video platforms or impose restrictions on URL schemes, destination ports, redirects, resolved IP addresses, or local and private network destinations. Because the browser executes from the agent's environment, it may have network access unavailable to the user. This creates an SSRF-like navigation risk in which a syntactically valid URL can target loopback services, private network hosts, link-local addresses, or cloud instance metadata services. Redirects from an initially acceptable public URL could produce the same outcome unless every redirect destination is validated. The skill's instruction to treat fetched content as untrusted mitigates prompt-injection risk, but it does not prevent unauthorized network requests or disclosure of content obtained from unintended destinations. ### Attack Path 1. An attacker sends a command such as `recipe `. 2. The URL passes the skill's generic format validation because no scheme, domain, IP-range, port, or redirect policy is specified. 3. Browser automation navigates to the supplied destination. 4. The destination resolves directly, or redirects, to a service reachable from the agent environment, such as a loopback, private-network, link-local, or metadata endpoint. 5. The skill captures the returned page text while attempting to identify a title, d ...[truncated 809 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.