ClawHub
Back to skill

Security audit

web-fetch

Security checks for vulnerabilities and agentic risk

Overview

This webpage-fetching skill is coherent but needs Review because it opens user-provided URLs with an unsandboxed browser and no URL safeguards, which could expose internal resources if misused.

Only install or run this skill in an isolated, non-privileged environment with no sensitive files, credentials, or internal network access. Use it only for URLs you are authorized to contact, and prefer a revised version that validates public http/https URLs, blocks local and private addresses across redirects, enables browser sandboxing, and pins dependencies with a lockfile.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/fetch.js:43
Finding

Unrestricted URL Navigation Enables Server-Side Request Forgery and Local Resource Access

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/fetch.js:29
Finding

Chromium Security Sandbox Is Explicitly Disabled for Untrusted Web Content

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/package.json:9
Finding

Mutable Dependency Resolution Without a Lockfile Creates Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file is written entirely in Chinese and does not indicate that language selection is optional or that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly performs live network access to arbitrary third-party URLs using a headless browser, but the description does not warn users that invoking it will contact external sites and expose request metadata such as IP address, headers, and browser fingerprint. Because it also advertises stealth-based anti-bot evasion, the omission reduces informed consent and can cause users to trigger external interactions they did not expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script's comments and all user-visible console output are in Chinese, including usage instructions and status/error messages. This imposes a specific language on users without any opt-in or alternative, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified with a caret range, which allows newer compatible releases to be installed over time rather than a single audited version. This weakens build reproducibility and can unexpectedly introduce vulnerable or malicious upstream changes into a browser-automation component with network access.

Content

Scanner excerpt · scripts/package.json (reported line 10)May include surrounding context.

json
"test": "echo \"Error: no test specified\" && exit 1"
  },
  "dependencies": {
    "playwright": "^1.58.2",
    "playwright-extra": "^3.1.2",
    "puppeteer-extra-plugin-stealth": "^2.11.2",
    "turndown": "^7.1.2"

Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

The manifest references playwright without pinning an exact version, while a known advisory exists affecting some releases. Because the installed version may vary, it is impossible to verify whether deployments are exposed to the browser-download authenticity issue, creating avoidable supply-chain risk in a tool that fetches external content and installs browser binaries.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

Using a semver range for playwright-extra permits unreviewed patch/minor updates to enter future installs, reducing supply-chain integrity and reproducibility. In a scraping skill that automates browsers and processes untrusted web content, even low-friction dependency drift increases risk.

Content

Scanner excerpt · scripts/package.json (reported line 11)May include surrounding context.

json
},
  "dependencies": {
    "playwright": "^1.58.2",
    "playwright-extra": "^3.1.2",
    "puppeteer-extra-plugin-stealth": "^2.11.2",
    "turndown": "^7.1.2"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The stealth plugin is unpinned, so future installs may pull in changed code without explicit review. Because this package alters browser behavior to evade anti-bot detection, unreviewed updates in this component are more sensitive than a typical utility library and could affect trust, detection surface, or introduce malicious logic.

Content

Scanner excerpt · scripts/package.json (reported line 12)May include surrounding context.

json
"dependencies": {
    "playwright": "^1.58.2",
    "playwright-extra": "^3.1.2",
    "puppeteer-extra-plugin-stealth": "^2.11.2",
    "turndown": "^7.1.2"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

Turndown is also declared with a caret range, so installs are not strictly reproducible and may incorporate unreviewed upstream changes. While lower risk than the browser automation stack, it still contributes to overall supply-chain exposure.

Content

Scanner excerpt · scripts/package.json (reported line 13)May include surrounding context.

json
"playwright": "^1.58.2",
    "playwright-extra": "^3.1.2",
    "puppeteer-extra-plugin-stealth": "^2.11.2",
    "turndown": "^7.1.2"
  }
}

Static analysis

No suspicious patterns detected.