Oxylabs AI Studio — Web Scraper, Crawler & Browser Agent

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:56 AM UTC
• Version: 1.0.3

Overview

The skill appears to be a real Oxylabs web automation wrapper, but its setup is too broad and can change the system Python environment.

Review before installing. Prefer installing the SDK in a virtual environment with a pinned version, do not run setup as root, and avoid using the skill with internal URLs, secret query strings, private pages, or regulated data unless you are comfortable sending that information to Oxylabs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: setup.sh:24

Finding

Unpinned Third-Party Package Installed into the System Python Environment

Content

View full analysis

Vulnerability Details

File Location: setup.sh:24
Vulnerability Type: Supply-chain exposure and unsafe system-wide dependency installation
Risk Level: Medium

Vulnerable Code

bash

pip3 install oxylabs-ai-studio --break-system-packages --quiet 2>/dev/null || pip3 install oxylabs-ai-studio --quiet 2>/dev/null

The corresponding manual installation instruction is also present at SKILL.md:46:

text

Or manually: pip3 install oxylabs-ai-studio --break-system-packages

Technical Analysis

The setup script downloads and installs the latest available release of oxylabs-ai-studio without an exact version pin or an integrity hash. The reviewed wrapper scripts subsequently import and execute code from this dependency.

The --break-system-packages option bypasses Python's externally managed environment protection and permits modification of the host's system Python environment. This exceeds the privileges required by the Skill, which could instead operate from an isolated virtual environment.

No evidence establishes that the current package is malicious. The vulnerability is the absence of dependency immutability and isolation: a compromised, replaced, or unexpectedly changed future package release could execute during installation or import. Suppressing standard error also reduces visibility into installation warnings and failures.

Attack Path

1. An attacker compromises the package publisher account, package distribution channel, or an eligible future release.
2. A user executes bash setup.sh.
3. pip3 resolves the package name to the latest available release because no exact version is specified.
4. Package installation code executes with the permissions of the user running setup and may modify the system Python environment.
5. When a wrapper script imports the installed SDK, attacker-controlled package code can execute again.
6. The imported dependency can access the process ...[truncated 865 chars]

Remediation

View remediation

Remediation Suggestions

1. Create and use a dedicated virtual environment rather than altering the system Python installation.
2. Pin the dependency to an audited exact version, for example with oxylabs-ai-studio==X.Y.Z.
3. Maintain a lock file or requirements file containing verified package hashes, and install with pip --require-hashes.
4. Remove --break-system-packages from both setup.sh and SKILL.md.
5. Avoid suppressing all standard-error output; preserve diagnostics needed to identify repository, certificate, and dependency-resolution failures.
6. Review and update the pinned dependency through a controlled process that includes provenance and security verification.
7. Run installation and the wrappers under a minimally privileged account with access only to the required API key and resources.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: setup.sh:5

Finding

Unnecessarily Broad Filesystem Enumeration During Setup

Content

View full analysis

Vulnerability Details

File Location: setup.sh:5-6
Vulnerability Type: Least-privilege violation through filesystem-wide discovery
Risk Level: Low

Vulnerable Code

bash

# Check if native Oxylabs plugin is already installed
NATIVE=$(find / -name "*oxylabs-ai-studio-openclaw-web-fetch*" -type f 2>/dev/null | head -1)

Technical Analysis

The installation script recursively traverses the entire accessible filesystem from / solely to determine whether a specific plugin file exists. Plugin detection should be limited to documented OpenClaw installation or plugin directories.

Although the script stores only the first matching path and the reviewed code does not transmit that path, the operation still inspects unrelated directories, user data trees, application paths, and mounted volumes accessible to the invoking account. Redirecting errors to /dev/null hides denied-access messages but does not narrow the scan.

This behavior exceeds the minimum access required for plugin detection. It can also traverse network mounts or large filesystems, resulting in avoidable I/O and installation delays.

Attack Path

1. A user or automation service invokes bash setup.sh.
2. The script starts find at the filesystem root.
3. find traverses every directory and mounted tree readable by that account.
4. Unrelated filesystem path metadata is inspected while the script searches for the filename pattern.
5. A matching file in any unrelated location can cause NATIVE to become nonempty.
6. The script then exits without installation, allowing an unrelated or intentionally planted matching filename to alter setup behavior.

Impact Assessment

The scan operates with all filesystem-read and traversal privileges held by the invoking account. When run under a privileged account, its scope can include nearly the entire host and attached mounts.

Confirmed consequences are excessive metadata enumeration ...[truncated 342 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace find / with checks against an explicit allowlist of documented OpenClaw plugin directories.
2. Prefer the platform's plugin registry, package manager, or supported discovery API when available.
3. Confirm that a discovered path is located in an approved directory and represents the expected plugin, rather than trusting a filename match alone.
4. Avoid traversing user home directories, temporary directories, remote mounts, and unrelated application trees.
5. Run setup without elevated privileges and add a bounded timeout if filesystem discovery remains necessary.
6. Keep detection behavior consistent with SKILL.md, which states that three missing tools are added when the native plugin is present, while the current setup script exits without installing anything.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares environment-variable requirements and installable scripts but does not define an explicit tool scope such as permissions or allowed-tools. That makes it easier for the agent to invoke code or access sensitive configuration without clear containment, increasing the chance of unintended execution paths or secret exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description promotes scraping and extraction through Oxylabs AI Studio but does not warn users that requested URLs, search terms, and extracted page content may be sent to an external service. This lack of disclosure can lead to privacy, confidentiality, and compliance issues if users unknowingly submit internal URLs, personal data, or sensitive content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are very broad and cover common actions like scrape, extract, crawl, and fetch page content, which can cause this skill to activate for many unrelated user requests. Over-broad activation raises the risk of unintended external requests, data transmission to third-party services, or use of browser automation where the user did not clearly consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends both a user-supplied URL and free-form prompt to the Oxylabs external service via BrowserAgent without any explicit disclosure, confirmation, or guardrails. This can expose sensitive targets, internal URLs, query parameters, or prompt contents to a third party, and in a scraping/browser-automation skill that data transfer is central to operation, which makes the finding more credible rather than less dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script sends a user-supplied URL and prompt to an external crawling service and outputs extracted content, but it provides no user-facing notice or consent boundary about external data transmission. This can cause users to unknowingly send internal URLs, sensitive pages, or proprietary content to a third party, which is more concerning because the skill is explicitly designed for broad web scraping and domain crawling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends a user-supplied URL to the external Oxylabs service without any notice, consent prompt, or validation that the target URL may contain sensitive query parameters, internal hostnames, or other confidential metadata. In an agent-skill context, this is dangerous because users may assume scraping happens locally, while the skill actually transmits the URL and request details to a third party, creating privacy, compliance, and data-leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup script performs a global Python package installation via pip3, including a fallback that may use --break-system-packages, which can modify the host environment outside an isolated virtual environment. This is risky because installing from the network during setup can introduce dependency changes, package conflicts, or unintended system-wide state changes without obtaining explicit user confirmation beyond a generic install message.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest scopes the skill around scraping, crawling, searching, and browser automation, but does not mention accessing local environment state for credentials. Reading an API key is a supporting capability rather than user-facing behavior, yet it is still a local-sensitive-data access that is not justified by the stated purpose alone.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.