ClawHub
Back to skill

Security audit

Web Summarizer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a simple web-page summarizer, but its URL handling can be abused to fetch local files or internal network resources instead of only public web pages.

Review before installing or using this skill in an environment with sensitive local files, localhost services, private networks, or cloud metadata access. It should restrict URLs to parsed http/https schemes, block private and local address ranges, and validate redirects before being treated as safe for untrusted URLs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/summarize.sh:14
Finding

Insufficient URL Validation Enables SSRF and Local File Disclosure

Content
View full analysis
/dev/null) ``` ### Technical Analysis The validation checks only whether the supplied string contains the substring `http`. It does not verify that the parsed URL uses the `http` or `https` scheme, despite the error message claiming that requirement. Because curl supports protocols other than HTTP by default, a crafted value such as: ```text file:///etc/passwd#http ``` can satisfy the substring check while directing curl to retrieve a local file. The retrieved data is processed by the Python extractors and included in the script's output. The script also accepts HTTP(S) URLs targeting loopback, private, link-local, and otherwise reserved addresses. This enables server-side request forgery against services accessible from the host. The `-L` option follows redirects without validating each redirect destination, so an initially public URL can redirect to an internal service or a non-HTTP resource supported by curl. Fetching user-selected web pages is necessary for the declared summarization functionality. Access to local files, private networks, cloud metadata services, and non-HTTP protocols exceeds the minimum privileges required. The pre-scan warning concerning remote script execution is not confirmed: curl output is assigned to `CONTENT` and processed as data; it is not piped into Bash or otherwise executed as shell code. ### Attack Path #### Local-file disclosure 1. An attacker supplies a crafted argument containing `http` but using the `file` sche ...[truncated 1757 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The script fetches arbitrary user-supplied URLs with curl and follows redirects, which creates a server-side request forgery risk if this skill runs in a trusted environment. An attacker could use it to access internal services, cloud metadata endpoints, or other network-reachable resources not intended for external users, and the fetched content is then processed and echoed back.

Content

Scanner excerpt · scripts/summarize.sh (reported line 24)May include surrounding context.

sh
echo ""

# Fetch content
CONTENT=$(curl -s --max-time 15 -L \
    -A "Mozilla/5.0 (compatible; AI-Agent/1.0)" \
    "$URL" 2>/dev/null)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises shell-based usage (bash scripts/summarize.sh ...) and mentions curl, but the manifest does not declare any permissions or allowed-tools scope. This creates an authorization and review gap: consumers cannot reliably tell that the skill may invoke shell/network-capable tooling, increasing the risk of unintended command execution or broader tool access than expected.

Content

No source excerpt is available for this finding.