Clawpod

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:01 PM UTC
• Version: 0.1.7

Overview

ClawPod is a coherent web-unblocking skill, but it needs review because it grants broad HTTPS curl authority and sends user URLs or searches through an external unblocker service.

Review before installing. Use this only for URLs and searches you are allowed to send to Massive's service, avoid secrets, internal-only URLs, regulated data, and sensitive personal queries, and prefer a version that restricts curl to the documented unblocker host and endpoints.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Overbroad curl Permission Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Overbroad network-tool authorization
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: Bash(curl --proto =https *)

Technical Analysis

The skill authorizes Bash execution of curl against any HTTPS destination. Its declared functionality only requires requests to the /browser and /search endpoints on unblocker.joinmassive.com. The wildcard therefore grants broader network access than necessary.

Although --proto =https prevents use of non-HTTPS protocols, it does not constrain the destination hostname, request headers, body, or transmitted data. If attacker-controlled content or instructions influence the agent, this permission could be used to send contextual information or accessible secrets to an unrelated HTTPS server.

The documented transmission of the target URL or search terms and MASSIVE_UNBLOCKER_TOKEN to Massive's API is necessary for the declared service and is not, by itself, hidden exfiltration. The vulnerability is the authorization of arbitrary HTTPS destinations rather than only the documented service.

Attack Path

1. A user asks the skill to fetch attacker-controlled content, or untrusted page content enters the agent's context.
2. The content includes instructions designed to induce an external curl request.
3. The agent treats those instructions as actionable and invokes the pre-authorized wildcard command.
4. curl connects to an attacker-controlled HTTPS endpoint because no hostname allowlist is enforced.
5. Sensitive context, user-provided data, or credentials included in the generated request are transmitted to the attacker.

Successful exploitation depends on the surrounding agent allowing untrusted input to influence tool invocation. No direct command-execution payload was found in the audited files.

Impact Assessment

The permission provides arbitrary outbound HTTPS access through curl, exceeding ...[truncated 535 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace wildcard Bash authorization with a narrowly scoped, typed HTTP tool or wrapper.
2. Restrict outbound requests to the exact hostname unblocker.joinmassive.com and only the required /browser and /search paths.
3. Enforce HTTPS certificate validation and prohibit redirects to unapproved hosts.
4. Keep the authorization token in a dedicated secret field that cannot be inserted into arbitrary request destinations.
5. Validate target URLs before submitting them:
   • Reject embedded user information.
   • Reject localhost, loopback, link-local, and private-network destinations unless explicitly required.
   • Detect or redact sensitive query parameters and fragments.
6. Treat fetched pages as untrusted data and prohibit their contents from authorizing or modifying subsequent tool calls.
7. Require confirmation before transmitting potentially sensitive URLs or search queries to the third-party API.
8. Avoid logging authorization headers, full sensitive URLs, or private search terms.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README promotes sending arbitrary URLs and search queries to a third-party 'unblocker' service that performs CAPTCHA solving, anti-bot bypass, geo-restriction evasion, and retrieval of protected content, but it does not warn users that their requests and fetched content are being transmitted to an external provider. In an agent-skill context, this omission is security-relevant because users may unknowingly expose sensitive targets, internal URLs, personal search terms, or regulated/protected content to a service explicitly designed to evade access controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill routes user-supplied URLs and search queries through a third-party proxy/search service and includes an authorization header in those outbound requests, but it does not prominently warn the user about that data sharing. This creates a real privacy and trust risk because users may disclose sensitive targets, search intent, or internal URLs without understanding that the requests leave the host environment and are processed by an external service designed to bypass protections.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The guidance says to use the language parameter to get results in a specific language, with a concrete example of forcing Spanish results. This encourages locale selection without stating that the language should come from the user's preference or explicit request, which can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.