ClawHub
Back to skill

Security audit

facebook-research

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Facebook research purpose, but its helper can send undocumented POST requests to broad Crawlora Facebook API paths using the user's API key.

Install only if you are comfortable giving the skill access to your Crawlora API key and allowing it to send Facebook-related requests to Crawlora. Review or restrict the helper before use if you want it limited strictly to the two documented read-only GET endpoints.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/crawlora.sh:38
Finding
Overly Broad HTTP Method and API Route Allowlist<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 38–64 **Vulnerability Type**: Insufficient authorization and least-privilege enforcement **Risk Level**: Medium ### Vulnerable Code ```bash method="GET" body="" args=() while [ $# -gt 0 ]; do case "$1" in -X) method="$2"; shift 2 ;; -d) body="$2"; shift 2 ;; *) args+=("$1"); shift ;; esac done [ "${#args[@]}" -ge 1 ] || { echo "usage: crawlora.sh [-X METHOD] /path [k=v ... | json-body]" >&2; exit 2; } path="${args[0]}" rest=("${args[@]:1}") # This skill's helper is limited to its documented Crawlora route set. Keep # caller-account surfaces and unrelated API routes out of the helper even if # someone supplies an undocumented path directly. case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the facebook-research skill" >&2 exit 2 ;; esac # Reject path syntax that could smuggle a route through a shell glob check. case "$path" in ""|*[?#%]*|*..*|*//* ) echo "invalid path for the facebook-research skill" >&2 exit 2 ;; esac case "$path" in /facebook/*) ;; /facebook/marketplace/search) ;; *) echo "path is not in the facebook-research skill catalog" >&2 exit 2 ;; esac ``` The accepted POST request is subsequently transmitted with the user's API key: ```bash printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" --data-binary @- "${base}${path}" ``` ### Technical Analysis The skill documentation declares only two operations, both using GET: 1. `GET /facebook/marketplace/search` 2. `GET /facebook/{page}` The helper nevertheless accepts both `GET` and `POST`, and its path check permits every route matching `/facebook/*`. The explicit `/facebook/marketplace/search` branch does not narrow the authorization boundary because that route already matches the preceding `/facebook/*` wildcard. Consequently, the script does not implement the documented endpo ...[truncated 2206 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Restrict the helper to the HTTP methods required by this skill: ```bash [ "$method" = "GET" ] || { echo "only GET is supported by the facebook-research skill" >&2 exit 2 } ``` 2. Replace the broad `/facebook/*` authorization rule with endpoint-specific validation: - Permit `/facebook/marketplace/search` exactly. - Permit only one validated Page identifier segment for Page lookups. - Reject empty identifiers, additional slashes, encoded delimiters, traversal syntax, and query or fragment characters. 3. Prefer separate wrapper functions or commands for Marketplace search and Page lookup rather than accepting arbitrary raw paths. Construct paths internally from validated arguments. 4. Remove POST body handling if no documented endpoint requires it. This reduces the possibility of invoking unintended state-changing operations. 5. Add negative tests confirming rejection of: - POST and other non-GET methods. - Nested paths such as `/facebook/admin/action`. - Unknown Marketplace subroutes. - Paths containing extra segments, traversal tokens, encoded separators, queries, or fragments. 6. Review the server-side API key's permissions and restrict it to the two documented read-only endpoints where Crawlora supports scoped credentials. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill uses shell-based helper commands (`scripts/crawlora.sh`) but does not declare any explicit tool scope or permissions boundaries. That increases the risk of overbroad execution in agent environments, because reviewers and runtime policy engines cannot easily constrain what commands the skill is expected to run.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.