SnapAPI — Web Intelligence for AI Agents

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:24 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward SnapAPI usage guide, with expected third-party URL and HTML processing that users should treat as external data sharing.

Install/use this only if you are comfortable sending requested URLs, page content, rendered HTML, and monitor targets to SnapAPI. Do not submit internal, authenticated, secret-bearing, regulated, or confidential content without approval, and verify the optional native plugin source before installing it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:162
• Finding: Unpinned and Unverified Third-Party Plugin Installation## Vulnerability Details **File Location**: `SKILL.md`, line 162 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Suspicious **Vulnerable Code Snippet**: ```markdown ## Works great with - **OpenClaw** — install the native plugin: `openclaw plugins install snapapi` - **LangChain** — use as a tool via the REST API - **n8n** — HTTP Request node pointing to any endpoint - **AutoGPT / any agent** — standard REST, no SDKs required ``` ### Technical Analysis The documented command installs the `snapapi` plugin through the OpenClaw package-resolution mechanism without specifying an immutable version, digest, checksum, verified source repository, or signature. Consequently, the code ultimately installed and executed is determined by mutable external registry state rather than by the contents reviewed in this project. The plugin implementation is not included in the audited project, so its provenance, installation hooks, runtime behavior, and requested permissions cannot be verified. This creates a supply-chain exposure: compromise of the registry, takeover of the package or publisher account, dependency confusion, or publication of a malicious future release could cause the same documented command to retrieve attacker-controlled code. ### Attack Path 1. An attacker compromises the relevant registry entry, publisher account, distribution infrastructure, or upstream package source for `snapapi`. 2. The attacker publishes a malicious release under the package name resolved by `openclaw plugins install snapapi`. 3. A user follows the installation instruction in `SKILL.md`. 4. Because no trusted version or immutable digest is specified, OpenClaw resolves the current externally supplied package. 5. The malicious plugin is installed and may execute through installation hooks, plugin initialization, or later invocation. 6. The payload operates with the permissions available to the OpenClaw proc ...[truncated 743 chars]
• Remediation: ## Remediation Suggestions 1. Pin the plugin to a specific, previously audited version rather than resolving the latest release implicitly. 2. Prefer an immutable package digest or commit identifier when supported. 3. Document the authoritative registry namespace and official source repository so users can verify package provenance. 4. Require cryptographic signature or checksum verification before installation. 5. Review and document installation hooks, runtime permissions, filesystem access, environment-variable access, and network destinations. 6. Publish a lockfile or equivalent integrity metadata for reproducible installation. 7. Consider vendoring the reviewed plugin implementation when practical, allowing its behavior to be audited together with the skill. 8. Run the plugin with least privilege in an isolated environment, exposing only the credentials and files required for its documented functions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill encourages users to submit arbitrary URLs and page content to SnapAPI but does not clearly warn that these inputs are transmitted to a third-party service. This can lead agents or users to send sensitive internal URLs, private web pages, or proprietary content off-platform without informed consent, creating confidentiality and compliance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

Useful for generating OG images, email previews, or screenshots from dynamic HTML:

```bash
curl -X POST "https://snapapi.tech/v1/render" \
  -H "X-API-Key: $SNAPAPI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"html": "<h1 style=\"color:blue\">Hello</h1>", "width": 800, "height": 400}'

• Confidence: 90% confidence
• Finding: The render example sends raw HTML to an external API for remote processing. If users pass sensitive templates, embedded tokens, customer data, or confidential content, that information leaves the local environment and may be stored, logged, or exposed by the provider.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The monitoring section describes recurring tracking and webhook delivery but omits warnings that this sets up continuous third-party polling and outbound notifications to a supplied webhook endpoint. Without disclosure, users may unintentionally enable persistent surveillance of targets or send change events to insecure or untrusted webhook receivers.

Static analysis

No suspicious patterns detected.