ClawHub
Back to skill

Security audit

cratesio-package-search-scraper-api-skill

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says by running a BrowserAct crates.io scraper, but it uses a BrowserAct API key and tells users they can provide that key directly to the agent.

Review this skill before installing. Use it only for intended crates.io BrowserAct scraping, set BROWSERACT_API_KEY through a local environment variable or secrets manager, and do not paste the BrowserAct API key into chat or agent prompts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill requires access to an environment variable and instructs the agent to invoke a Python script that makes external API calls, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: an agent or reviewer may underestimate the skill’s ability to read secrets and send data over the network, increasing the risk of unintended secret exposure or unauthorized outbound requests.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The activation text includes broad phrases such as exporting public records, enriching datasets, monitoring public web data, and calling the template by API, which can match many generic scraping or data-collection requests beyond this narrowly scoped crates.io use case. Over-broad triggering can cause the wrong skill to run in unrelated contexts, leading to unnecessary secret use, unintended network calls, or data being sent to a third-party service without clear user intent.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The script explicitly tells the user to 'Provide it to me or set it as an environment variable,' which invites disclosure of a secret API key directly to the agent. In an agent setting, prompting users to paste credentials into chat or tool inputs increases the risk of credential exposure through logs, transcripts, or unintended handling.

Ssd 3

Medium
Confidence
99% confidence
Finding
This is a direct plain-language request for sensitive credential disclosure to the agent. Even if intended for convenience, it normalizes unsafe secret sharing and can lead to compromise of the BrowserAct account if the conversation, logs, or downstream systems retain the credential.

Static analysis

No suspicious patterns detected.