ClawHub
Back to skill

Security audit

Scrape

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed web-scraping guide, but its sample compliance code can allow scraping when robots.txt checks fail.

Review before installing or using the sample code. The guidance is not deceptive and does not install anything, but users should change the robots.txt check to fail closed or ask before proceeding on errors, and add URL/redirect/IP validation before using the fetcher in any shared tool, server, or workflow that accepts user-supplied URLs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
code.md:15
Finding

Fail-Open robots.txt Validation Permits Scraping Without Confirmed Authorization

Content
View full analysis
Remediation
View remediation
RobotsDecision: parsed = urlparse(url) robots_url = f"{parsed.scheme}://{parsed.netloc}/robots.txt" rp = RobotFileParser() rp.set_url(robots_url) try: rp.read() except Exception: return RobotsDecision.INDETERMINATE return ( RobotsDecision.ALLOWED if rp.can_fetch(user_agent, url) else RobotsDecision.DISALLOWED ) ``` ]]>

T09 · Insecure Skill Coding Practices

Error
Location
code.md:48
Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
- **Public data, no login** — Generally legal (hiQ v. LinkedIn 2022)
- **Bypassing barriers** — CFAA violation risk (Van Buren v. US 2021)
- **Ignoring robots.txt** — Gray area, often breaches ToS (Meta v. Bright Data 2024)
- **Personal data without consent** — GDPR/CCPA violation
- **Republishing copyrighted content** — Copyright infringement

## Request Discipline

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The robots.txt compliance check fails open: any exception while fetching or parsing robots.txt causes the function to return True and allow scraping. In a scraping skill whose stated purpose is legal, robots.txt-compliant operation, this makes policy bypass likely during transient network errors, DNS/TLS failures, parser issues, or deliberate blocking of robots.txt retrieval.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The comment says 'No robots.txt = allowed', but the code actually allows scraping on any exception from rp.read(), not just when robots.txt is absent. This mismatch is dangerous because maintainers may believe the logic is narrowly permissive while it actually bypasses robots enforcement under many failure conditions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example session setup forces Accept-Language: en-US,en;q=0.9 for all requests. This is a natural-language/locale policy concern because it imposes a specific language preference without offering user opt-in or documenting why an English-only locale is required.

Content

No source excerpt is available for this finding.