ClawHub
Back to skill

Security audit

obscura

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marks this skill suspicious because its browser-control MCP example is reported to expose an endpoint over plaintext HTTP without a warning; no clear malicious intent is reported, and scan coverage is incomplete.

Before installing, consider whether you need this skill and whether its browser-control endpoint would be reachable beyond your local machine. The scan reports an unsafe plaintext HTTP example and an undeclared tool scope. Skillspector analyzed the listed seven components, but marked its analysis partial because several local path-like references could not be resolved, so the evidence is incomplete.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_write, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The network-accessible MCP example lacks a warning about exposing browser control over plaintext HTTP.

Medium
Category
Output Handling
Confidence
96% confidence
Finding

The example binds a browser-control MCP endpoint to all interfaces over plaintext HTTP without explaining transport protection or network restrictions. Even if OBSCURA_MCP_TOKEN enforces authentication, an on-path attacker could capture the token and browser data, potentially gaining control of browser sessions accessible through the service.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium
Category
Output Handling
Confidence
80% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · references/cli.md (reported line 177)May include surrounding context.

--font-dir

Recursively load TTF, TTC, OTF, and OTC files from this directory. Repeat for multiple directories. Requires a render-enabled build --quiet Suppress all logs (same as on fetch). Useful when scraping pages that flood the console with per-page script warnings (issue #264) -h, --help Print help

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

obscura fetch https://example.com --eval "document.title" obscura fetch https://news.ycombinator.com --dump text obscura fetch https://example.com --dump links obscura fetch https://api.github.com/repos/OWNER/REPO --dump original | jq .id obscura fetch https://app.example.com --eval "JSON.stringify({t:document.title,rows:document.querySelectorAll('tr').length})"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/smoke.sh (reported line 42)May include surrounding context.

sh
python3 -c 'import json,sys; d=json.loads(sys.argv[1]); assert d["n"]>0' "$j" 2>/dev/null \
  && ok "fetch --eval JSON.stringify parses" || bad "fetch --eval JSON.stringify" "$j"

orig=$(obscura fetch https://api.github.com/repos/h4ckf0r0day/obscura --dump original -q 2>/dev/null)
contains "fetch --dump original returns raw JSON" '"full_name"' "$orig"

# --- scrape ---