ClawHub
Back to skill

Security audit

Decodo Scraper

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it sends chosen searches and URLs to Decodo's scraping API, with dependency hygiene issues but no hidden or destructive behavior found.

Install this only if you intend to use Decodo as a third-party scraping provider. Treat submitted URLs, search terms, video IDs, and retrieved content as visible to Decodo, keep DECODO_AUTH_TOKEN out of shared logs and repositories, avoid credential-bearing or private/internal URLs, and pin dependencies or use a lockfile in production.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares required credentials and clearly performs networked scraping operations, but it does not declare permissions corresponding to environment access and outbound network use. This weakens platform-level transparency and review because users and operators may not realize the skill can read a token from the environment and transmit user-supplied inputs to an external service.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill encourages users to provide URLs, search queries, Reddit links, and YouTube video IDs, but the description does not prominently warn that these inputs are sent to Decodo's external scraping API. This creates a privacy and data-handling risk because users may unknowingly submit sensitive internal URLs, proprietary queries, or other confidential identifiers to a third party.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
python-dotenv>=1.0.0
Confidence
96% confidence
Finding
requests>=2.28.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
python-dotenv>=1.0.0
Confidence
94% confidence
Finding
python-dotenv>=1.0.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
92% confidence
Finding
requests

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.