ClawHub
Back to skill

Security audit

Jina CLI

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Jina web-reading/search helper, but users should be careful with the remote installer and avoid passing real login cookies unless they understand the risk.

Install only if you trust the GitHub installer and Jina CLI binary. Prefer public URLs and searches; do not pass browser session cookies unless you intentionally want those credentials used for the request and understand they may be exposed to the CLI and Jina service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation explicitly encourages forwarding cookies to the remote Jina Reader API using `--cookie`, which can transmit session tokens or other sensitive authentication data to a third-party service. In a skill focused on arbitrary URL reading and social media extraction, this is especially risky because users may paste live session cookies without understanding they are being disclosed off-origin.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal