Claw Web Fetch

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:50 PM UTC
• Version: 1.0.12

Overview

This appears to be a legitimate web-fetching wrapper, but its setup downloads and runs npm code that is not fully pinned or reviewed with the skill.

Review before installing. Use this only if you trust the published clawfetch npm package and its dependencies, and run bootstrap/runtime install in a low-privilege environment without sensitive credentials. Prefer a pinned, lockfile-backed, integrity-verified install path before using it in sensitive agent environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: bootstrap_deps.sh:4

Finding

Unverified npm Dependencies and Lifecycle Scripts Permit Supply-Chain Code Execution

Content

View full analysis

/dev/null 2>&1; then CLAWFETCH_VERSION=$(node -e "process.stdout.write(require(process.argv[1]).version)" "$PROJECT_PACKAGE") else CLAWFETCH_VERSION="$FALLBACK_VERSION" fi cd "$SCRIPT_DIR" npm install --no-save --install-strategy=shallow "clawfetch@$CLAWFETCH_VERSION" CLAWFETCH_ROOT="$SCRIPT_DIR/node_modules/clawfetch" CLAWFETCH_CLI="$CLAWFETCH_ROOT/clawfetch.js" if [ ! -f "$CLAWFETCH_CLI" ]; then cat >&2 <

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

1. Find the installed skill directory, the directory containing this `SKILL.md` and `bootstrap_deps.sh`.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

max_timeout_ms = 60000

text

To enable FlareSolverr, edit this skill directory's `clawfetch.toml`, set `enabled = true`, and set `url` to a reachable FlareSolverr-compatible service. `FLARESOLVERR_URL` remains supported only as a compatibility or temporary override; it is not the preferred skill configuration path.

## Invocation

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README explicitly instructs agents to install an npm package, install a browser runtime, and fetch external content, but it does not prominently warn that these steps cause network access and local filesystem changes. In an agent-executed skill context, that omission can lead to unsafe automatic execution or user surprise, especially because runtime installation may download binaries and fetching transmits data to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The FlareSolverr configuration section explains how to route requests through an additional service but does not clearly warn that fetched URLs and browsing traffic may be sent to that external endpoint. In a security-sensitive agent environment, this can cause unintentional disclosure of browsing targets, content, or metadata to another service under separate trust and logging controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file describes commands that install a browser runtime and fetch remote webpages, which can affect system state and transmit network requests. Although the document explains the steps, it does not explicitly warn users that these operations will download components and access external sites.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: clawfetch.toml:6