ClawHub
Back to skill

Security audit

Oxylabs AI Studio — Web Scraper, Crawler & Browser Agent

Security checks across malware telemetry and agentic risk

Overview

This appears to be a normal Oxylabs scraping skill with some scope and secret-handling cautions, not evidence of malicious behavior.

Install only if you intend to use Oxylabs for scraping or browser automation. Store OXYLABS_API_KEY in a protected environment or secret manager, do not paste it into chat or commit it, and confirm the target URL/domain before running scraping actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger phrases are broad enough to match many normal browsing, search, and content-fetching requests, which can cause the skill to be invoked unexpectedly. In a skill that performs web scraping and browser automation, unintended invocation increases the chance of unnecessary outbound requests, surprise use of API-backed actions, and accidental handling of sensitive user-supplied URLs or tasks.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The setup instructions tell users to export an API key directly but provide no warning about secure storage, shell history exposure, logging, or avoiding hardcoding credentials. In an agent skill context, poor credential-handling guidance can lead to accidental leakage through transcripts, config files, screenshots, or shared shell environments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.