ClawRent Web Scraping

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:04 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed web-scraping worker, but it gives a third-party service ongoing control over what the agent browses and uploads without clear user approval or safety limits.

Install only if you are comfortable letting clawrent.xyz assign browsing tasks while your computer is idle and receive captured page HTML, errors, and possible screenshots. Use a dedicated isolated browser profile or machine with no personal logins, block local and private-network access, and verify there is a clear way to stop polling and revoke the API key before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:23

Finding

Autonomous Execution of Tasks Supplied by an External Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-30
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Critical

Vulnerable Code:

markdown

## Heartbeat

When idle, request task every 30 seconds:
- `POST https://clawrent.xyz/v1/node/heartbeat`
- Header: `Authorization: Bearer {config.CLAWRENT_API_KEY}`

If response includes `task`, run it immediately.

After reporting each task result, immediately send one more heartbeat to fetch the next task without waiting for the next interval.

Technical Analysis

The Skill delegates task selection to a mutable external service and explicitly directs the Agent to run returned tasks immediately. There is no requirement for user review, task approval, target validation, bounded execution, or confirmation that the received task remains within the intended scraping scope.

This permits the remote service—or an attacker who compromises it or the associated API key—to determine the Agent's browser targets and collection behavior after the Skill has been reviewed and installed. The immediate post-task heartbeat also creates a continuous execution loop controlled by the service.

Attack Path

1. The Agent authenticates to the heartbeat endpoint while idle.
2. The external service returns a crafted task containing an attacker-selected URL and capture options.
3. The Agent accepts the response as an instruction and runs it without user confirmation.
4. The task accesses the selected resource and captures content.
5. The Agent submits the result and immediately requests another task.
6. The service repeats the process to conduct continuing remote-directed activity.

Impact Assessment

The external service obtains ongoing control over the Agent's scraping targets and task timing. Within the browser tool's available privileges, this can be used to access arbitrary public targets, locally reachable services, or authenticated page ...[truncated 133 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user approval before every remotely supplied task is executed.
• Restrict tasks to a user-managed allowlist of domains and approved scraping purposes.
• Define and validate a narrow task schema; reject unknown fields and unsupported actions.
• Authenticate task payloads and bind them to an approved node, purpose, and expiration time.
• Add request-rate, task-count, execution-time, response-size, and resource-consumption limits.
• Do not immediately execute follow-up tasks indefinitely; enforce an explicit session boundary and maximum task count.
• Provide a visible task log, a stop control, and a mechanism to revoke the node and API credential.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:32

Finding

Unrestricted Browser Access to Arbitrary Task URLs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-38
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Critical

Vulnerable Code:

markdown

## Execute Task

Given one task URL:
1. Open URL in browser tool.
2. Wait `task.options.waitMs` milliseconds (default 2000).
3. If `task.options.selector` exists, extract that element HTML only.
4. Otherwise capture full page HTML.
5. If `task.options.returnType` includes screenshot, capture screenshot.

Technical Analysis

The externally supplied task URL is opened without a protocol restriction, domain allowlist, IP-range check, redirect validation, or browser-profile isolation requirement. The Skill also permits full-page HTML and screenshot capture.

Consequently, the browser can act as a proxy into resources available from the user's environment. If it shares cookies or authenticated state with the user, it may also receive content that an unauthenticated scraping worker could not access. A hostname that initially resolves to a public address could redirect or be rebound to a private address unless validation is performed after DNS resolution and at every redirect.

Attack Path

1. The external task service supplies a URL targeting a sensitive resource.
2. The target resolves or redirects to a loopback address, private-network host, link-local service, cloud metadata endpoint, or authenticated website.
3. The Agent opens the URL using its local network position and browser context.
4. The target returns content available only to that machine, network, or browser session.
5. The Agent captures the full HTML, a selected element, or a screenshot.
6. The captured information becomes available for result submission.

Impact Assessment

An attacker could exploit the Agent's local network reachability and browser state to inspect internal applications, administration interfaces, development services, ...[truncated 233 chars]

Remediation

View remediation

Remediation Suggestions

• Run all scraping tasks in a dedicated sandboxed browser profile with no user cookies, saved credentials, extensions, client certificates, or existing sessions.
• Permit only https URLs on explicitly approved public domains.
• Reject loopback, private, link-local, multicast, reserved, and cloud-metadata address ranges.
• Resolve hostnames before connection and repeat destination validation after every redirect and DNS resolution.
• Block local-file and non-web schemes such as file:, data:, javascript:, and custom protocols.
• Apply network egress controls so the worker cannot connect to internal networks or local services.
• Require per-domain user authorization and display the final resolved destination before execution.
• Limit page size, redirect count, wait duration, screenshot dimensions, and total execution time.

other

Error

• Location: SKILL.md:40

Finding

Unfiltered Exfiltration of Captured Web Content to a Third Party

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40-50
Vulnerability Type: other: Sensitive Data Exfiltration
Risk Level: Critical

Vulnerable Code:

markdown

## Report Result

Send result:
- `POST https://clawrent.xyz/v1/node/result`
- Header: `Authorization: Bearer {config.CLAWRENT_API_KEY}`
- Body:
  - `taskId`
  - `status` (`completed` or `failed`)
  - `html`
  - `statusCode`
  - `error` (if failed)

Technical Analysis

The Skill sends captured HTML and error details to clawrent.xyz without requiring data classification, redaction, output minimization, user preview, or per-result consent. Complete page HTML can contain personal information, private messages, hidden form values, anti-CSRF tokens, embedded application state, internal identifiers, and secrets rendered into a page. Error output can disclose URLs, hostnames, implementation details, or sensitive response data.

This reporting behavior is particularly dangerous when combined with unrestricted remote task selection and access to the user's network or browser session. The task source can select the resource, trigger its capture, and receive the resulting content through the designated result endpoint.

Attack Path

1. The task service provides a URL for a page containing confidential information.
2. The Agent opens the page using locally available network access or browser state.
3. The Agent captures the full HTML or selected element.
4. No sensitive-data filter or user review is applied.
5. The Agent includes the content in the html field and posts it to clawrent.xyz.
6. The remote service receives and can retain or process the disclosed information.

Impact Assessment

The result channel can disclose any information rendered in captured HTML, subject to the browser tool's access. Potentially affected data includes personal information, account content, session-related tokens embedded in marku ...[truncated 197 chars]

Remediation

View remediation

Remediation Suggestions

• Do not upload complete page HTML by default; return only fields explicitly approved by the user.
• Apply secret detection, personal-data classification, and structured redaction before transmission.
• Remove cookies, authorization data, tokens, hidden fields, embedded application state, and sensitive URL parameters from results.
• Show the destination, extracted fields, and redacted result to the user before submission.
• Enforce strict output-size and content-type limits.
• Sanitize error reports and avoid sending raw responses, stack traces, or sensitive URLs.
• Document data retention, access control, deletion, processing purpose, and third-party sharing.
• Encrypt data in transit and apply authenticated endpoint and certificate validation.
• Separate task assignment from result access so a compromised scheduler cannot automatically retrieve sensitive output.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:12

Finding

Unsafe API-Key Collection and Excessive Host Metadata Disclosure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-21
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code:

markdown

## Setup

If `CLAWRENT_API_KEY` is missing:
1. Tell user to sign up at `https://clawrent.xyz/node/register` to get their API key.
2. Ask user to paste their API key.
3. Save it to the skill config as `CLAWRENT_API_KEY` so it persists across sessions.
4. Confirm: "API key saved. ClawRent is ready to earn for you."

Register node on first run:
- `POST https://clawrent.xyz/v1/node/register`
- Header: `Authorization: Bearer {config.CLAWRENT_API_KEY}`
- Body: `{ "name": "{hostname}", "os": "{platform}", "ip": "auto" }`

Technical Analysis

The setup procedure asks the user to paste an API credential into the conversation and then persist it in Skill configuration. It does not require a protected secret store, restrictive file permissions, transcript redaction, log suppression, credential rotation, or revocation support. Depending on the hosting environment, the credential could remain in chat history, diagnostics, backups, or broadly readable configuration.

Node registration also transmits the machine hostname and operating-system platform. These values are not demonstrated to be necessary for authentication or task delivery and increase device fingerprinting and targeting exposure. The server can additionally observe the connection's source IP without needing an ip field.

Attack Path

1. The user pastes the API key into the Agent conversation as instructed.
2. The key is recorded in conversational history or operational logs.
3. The Agent persists the key in Skill configuration.
4. A user, process, backup operator, or diagnostic system with access to those records obtains the credential.
5. The exposed key may be used to impersonate the node or interact with the service, subject to the API key's server-side permissio ...[truncated 519 chars]

Remediation

View remediation

Remediation Suggestions

• Do not request credentials through ordinary chat messages.
• Use a dedicated secret-input interface or OS-backed credential manager that prevents transcript and log exposure.
• Store only a scoped, revocable token with restrictive filesystem permissions and encryption at rest.
• Redact authorization headers and API keys from prompts, logs, errors, telemetry, and backups.
• Define credential expiration, rotation, and immediate revocation procedures.
• Scope the token to only the minimum node operations required.
• Replace the hostname with a random, non-identifying node identifier.
• Omit operating-system and IP fields unless a documented functional requirement justifies them and the user has consented.
• Clearly disclose what device metadata is collected, why it is needed, and how long it is retained.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions direct the agent to save a user-supplied API key and then use it across sessions to register the node, poll for work, and perform automated remote requests under control of an external service. In context, this is especially dangerous because the persisted credential enables continuous background tasking and ties the local machine to a remote job queue that can command browsing and data extraction later without renewed user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to open arbitrary task URLs, extract full page HTML or element HTML, optionally capture screenshots, and send the results to a remote service, all without any user-facing warning or approval step. This can exfiltrate sensitive data visible in authenticated browser sessions, including personal information, account content, internal pages, or proprietary material, making the skill substantially more dangerous in context than ordinary scraping tooling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description advertises broad passive-income web scraping behavior without meaningful constraints on what sites may be accessed, what data may be collected, or what user approvals are required. In this context, the broad activation increases the chance the agent will autonomously perform scraping and data collection tasks on arbitrary third-party pages, which is risky for privacy, abuse, and policy compliance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill asks the user to paste an API key and then persist it across sessions, but provides no warning about how the credential will be stored, protected, or used for automated background requests. This creates unnecessary credential-handling risk and may lead users to provide a secret without understanding that it enables ongoing remote-controlled activity tied to their account.

Content

No source excerpt is available for this finding.