ClawHub
Back to skill

Security audit

Jina Reader

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Jina web reader/search helper that sends requested URLs or search queries, and optionally a Jina API key, to Jina as part of its advertised function.

Install this only if you are comfortable sharing the URLs you fetch and the searches you run with Jina AI. Use a dedicated JINA_API_KEY if needed, unset it when you do not want authenticated requests, and avoid using the skill for confidential internal links, signed URLs, secrets, or sensitive personal data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documentation indicates use of network access and environment variables (for JINA_API_KEY), but no permissions are declared. That mismatch can mislead operators about the skill's capabilities and reduce informed consent, especially because the skill can send arbitrary user-provided URLs and queries to external services. In this context, the risk is increased because the stated purpose is broad web fetching/search, which inherently involves exfiltrating requested targets and possibly sensitive URLs to third-party infrastructure.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger list is very broad, including generic phrases like 'look up', 'get the content of', and 'summarize this link', which can cause the skill to activate in situations the user did not specifically intend. Because the skill performs outbound network requests to third-party services, accidental invocation can result in unintended disclosure of URLs, queries, or referenced resources. The context makes this more dangerous than a harmless local utility because activation immediately causes external data transfer.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script sends any user-supplied URL to the external Jina Reader service and may also attach a bearer token from the environment, but it does not clearly warn the user that both the target URL and optional credential are being transmitted to a third party. In a skill intended to fetch arbitrary links on behalf of users, this creates a real privacy and data-handling risk, especially if users provide sensitive internal, signed, or otherwise confidential URLs.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This script sends the user-supplied search query, and optionally an API key, to the external Jina Search service over the network. Even though the transport uses HTTPS, the code provides no user-facing disclosure, consent, or data-classification guardrails, which is risky in an agent skill because prompts may contain sensitive user data that gets exfiltrated to a third party.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.