ClawHub
Back to skill

Security audit

Web Monitor

Security checks for vulnerabilities and agentic risk

Overview

This web-monitoring skill is not clearly malicious, but it needs review because it disables HTTPS certificate checks and can run arbitrary local shell commands when a page changes.

Install only if you are comfortable with a monitor that can execute any command you pass to --notify and that currently does not authenticate HTTPS sites. Avoid using --notify for sensitive or privileged actions, do not run it as an administrator or service account, and treat monitored content and notification destinations as potentially sensitive until TLS verification and safer notification handling are fixed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/monitor.py:27
Finding

HTTPS Certificate and Hostname Verification Disabled

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/monitor.py:105
Finding

Arbitrary Shell Command Execution Through Notification Hook

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/examples.md:54
Finding

Documentation Recommends Installation of an Unpinned Third-Party Package

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented behavior materially understates the risk of the implementation: arbitrary shell commands may run via --notify, SSL verification is reportedly disabled, and the advertised selector support is misleading. The most serious issue is command execution and insecure transport, which can enable remote abuse, interception, or unexpected code execution in a skill that appears to be a simple web monitor.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Allowing arbitrary shell commands for notifications is not necessary for basic web-page monitoring and materially expands the skill's capabilities. It creates a dangerous execution surface where a simple content monitor can launch any local command, which is disproportionate to the stated purpose.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
99% confidence
Finding

The script executes the raw --notify argument with os.system(), which invokes a shell and allows arbitrary command execution. In a monitoring skill, this turns a content-change event into a shell execution primitive; if the argument is influenced by untrusted input, wrappers, or automation, it can run unintended commands with the user's privileges.

Content

Scanner excerpt · scripts/monitor.py (reported line 113)May include surrounding context.

python
print(f"Previous: {prev['hash'][:16]}...")
                print(f"Current:  {current_hash[:16]}...")
                if args.notify:
                    os.system(args.notify)
                return 2
        else:
            print(f"No previous data to compare (file: {args.compare})")

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

In continuous watch mode, arbitrary command execution is even more dangerous because remote page changes can repeatedly trigger local actions. This makes the skill substantially riskier in context: a website monitor should not function as an unattended command executor driven by network content.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
99% confidence
Finding

In watch mode, every detected change can trigger os.system(args.notify), repeatedly executing an arbitrary shell command. This increases risk because a monitored page can indirectly cause repeated command execution, turning the tool into a general-purpose command runner tied to external web content.

Content

Scanner excerpt · scripts/monitor.py (reported line 131)May include surrounding context.

python
if new_hash != current_hash:
                        print(f"\n[{datetime.now().isoformat()}] CHANGE DETECTED!")
                        if args.notify:
                            os.system(args.notify)
                        current_hash = new_hash
                        data['hash'] = new_hash
                        data['content'] = new_content if not args.hash_only else None

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises and documents capabilities that imply network access, file writes, and shell execution, but it does not declare any tool scope or permission boundaries. This is dangerous because consumers and enforcement layers cannot accurately restrict what the skill may do, increasing the chance of unintended command execution, outbound requests, or filesystem modification during use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The markdown normalizes use of a notification feature that executes shell commands on change detection without any warning or guardrails. In the context of an automation skill, this can lead users to embed unsafe commands or route untrusted page-change data into the shell, creating a realistic path to command injection or harmful local command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file documents a webhook example using curl to post to a Slack webhook, which is a network transmission to an external service. The surrounding examples and notification section do not provide any user warning about privacy, data disclosure, or the fact that page-change information may be sent off-system.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 64)May include surrounding context.

Webhook

bash
curl -X POST "https://hooks.slack.com/services/XXX" -d "{\"text\":\"Change detected\"}"

Email (using msmtp)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The module description omits a material security behavior: HTTPS certificate verification is disabled for all requests. This is misleading because users may reasonably assume normal TLS protections, making them less likely to recognize that content can be intercepted or altered by a man-in-the-middle attacker.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code disables hostname checking and certificate verification, so HTTPS connections no longer authenticate the server. An attacker on the network path can tamper with monitored content, suppress or fabricate changes, and influence downstream actions such as notifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The tool exposes arbitrary command execution through --notify without clearly warning users that local shell commands will be run on detected changes. Even when user-configured, this is security-relevant functionality that can be misused or misunderstood, especially in automation contexts.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/monitor.py:29