ClawHub
Back to skill

Security audit

Web Distiller

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward hosted webpage-to-Markdown integration, with some normal third-party API and package-install risks users should understand.

Install this only if you are comfortable sending chosen webpage URLs to Distiller's hosted service. Avoid submitting private intranet pages, authenticated pages, regulated data, or sensitive customer content unless your organization has approved that data flow. Prefer installing the CLI in a virtual environment, pin a reviewed package version when possible, and use a revocable Distiller API key with limited exposure.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:31
Finding

Unpinned Third-Party Package Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 31
Vulnerability Type: Unpinned and unaudited third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

bash
pip install web-distiller

Technical Analysis

The skill instructs operators to install the web-distiller package directly from the package index without an exact version constraint, integrity hash, lockfile, or bundled source code. Python package installation can execute package-controlled build or installation logic. The installed package is subsequently invoked as a command-line program and may inherit the operator's environment, including DISTILLER_API_KEY.

Because this project contains only documentation and configuration, the behavior and provenance of the external package cannot be verified from the audited artifact. A compromised publisher account, malicious package release, package-index compromise, or future unsafe update could therefore introduce arbitrary code after this skill has been reviewed.

Attack Path

  1. An attacker compromises the package publisher, distribution channel, or a transitive dependency and publishes a malicious release.
  2. An operator follows the documented pip install web-distiller instruction.
  3. Since no version or hash is specified, pip resolves the currently available package release.
  4. Malicious package installation logic or the installed CLI executes with the operator's local user privileges.
  5. The package may read accessible files and environment variables, including the configured Distiller API key, and transmit them to an attacker-controlled service.
  6. The package may perform any other action permitted to the installing or invoking user.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user installing or running the package. The accessible scope may include the user's files, process environment, netwo ...[truncated 623 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact, reviewed release, for example web-distiller==X.Y.Z.
  2. Provide cryptographic hashes for the approved distribution artifacts and require hash verification during installation, such as through a requirements file used with pip install --require-hashes.
  3. Include the CLI source code in the reviewed project or link clearly to its authoritative source repository and reproducible release artifacts.
  4. Add a dependency lockfile covering all transitive dependencies and review changes before updating it.
  5. Publish package provenance or signing information and document how operators can verify the publisher and artifact integrity.
  6. Recommend installation inside an isolated virtual environment under a non-privileged user rather than through a system-wide or administrator-level installation.
  7. Limit credential exposure by providing DISTILLER_API_KEY only to the process that requires it and by using a narrowly scoped, revocable API key.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to send arbitrary webpage URLs to a hosted third-party API and configure an API key, but it does not clearly warn that requested URLs and fetched page contents will be transmitted off-host to an external service. In an agent skill context, this can lead operators to route sensitive internal, authenticated, or otherwise non-public targets through the service without understanding the data exposure boundary.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 52)May include surrounding context.

md
- a referred user signs up with that referral code
- bonuses are applied after the referred user verifies their email

Use the main skill at [SKILL.md](/C:/projects/distiller/openclaw-skill/web-distiller/SKILL.md) for actual OpenClaw setup and webpage extraction.

Do not tell operators to set `DISTILLER_REFERRER_TOKEN` or forward referral headers. That legacy token flow has been removed.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · REFERRAL_SKILL.md (reported line 11)May include surrounding context.

md
- a referred user signs up with that referral code
- bonuses are applied after the referred user verifies their email

Use the main skill at [SKILL.md](/C:/projects/distiller/openclaw-skill/web-distiller/SKILL.md) for actual OpenClaw setup and webpage extraction.

Do not tell operators to set `DISTILLER_REFERRER_TOKEN` or forward referral headers. That legacy token flow has been removed.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Submit a markdown batch by default:

bash
curl -X POST https://webdistiller.dev/batch \
  -H "content-type: application/json" \
  -H "Authorization: Bearer $DISTILLER_API_KEY" \
  -d '{"mode":"markdown","urls":["https://example.com","https://example.org"]}'

Static analysis

No suspicious patterns detected.