ClawHub

Outscraper

Security checks across malware telemetry and agentic risk

Overview

This is a real Outscraper/Membrane integration, but it grants broad authenticated scraping and data-enrichment capability that is under-scoped in the summary.

Install only if you intend to use Outscraper through Membrane and are comfortable with authenticated web scraping, contact discovery, and third-party data processing. Keep requests narrowly scoped, avoid unauthorized collection of personal/contact data, review Membrane and Outscraper permissions, and consider pinning or reviewing the Membrane CLI before global installation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest frames the skill as 'Manage Organizations,' but the body exposes a very broad set of capabilities including scraping, proxying, verification, translation, and people/company intelligence. That mismatch increases the chance an agent or user invokes sensitive or high-risk functionality outside the expected scope, undermining least privilege and informed consent.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill documents a generic authenticated proxy capability that can send arbitrary requests to the Outscraper API through Membrane. This bypasses the safer, discoverable action model and materially expands the skill into an open-ended network/data access primitive, which could be used to access endpoints or process data beyond the stated organization-management purpose.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The proxy request instructions encourage direct transmission of requests and data to Outscraper without any warning about privacy, third-party processing, or legal/compliance implications. In a scraping and enrichment context, that omission is risky because users may unknowingly send personal, proprietary, or regulated data to an external service.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal