Security audit

clean-web-fetch

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate webpage-extraction purpose, but it tells agents to run missing, unreviewed scripts from relative and developer-specific absolute paths.

Install only if you trust and can inspect the referenced fetch script yourself. Prefer a version that bundles its executable files, resolves them relative to the skill package, pins dependencies in an isolated environment, and restricts fetching to user-approved public HTTP/HTTPS URLs.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Warning

Location: SKILL.md:11
Finding: Execution of Unbundled and Unverified External Tools
Content: View full analysis
``` ```bash python3 /Users/zzd/.openclaw/workspace/skills/scrapling-web-fetch/scripts/scrapling_fetch.py 30000 ``` ```text - 用法参考：`/Users/zzd/.openclaw/workspace/skills/scrapling-web-fetch/references/usage.md` - 选择器策略：`/Users/zzd/.openclaw/workspace/skills/scrapling-web-fetch/references/selectors.md` - 统一入口：`/Users/zzd/.openclaw/workspace/skills/scrapling-web-fetch/scripts/fetch-web-content` ``` ### Technical Analysis The project contains only `SKILL.md`; it does not include `scripts/scrapling_fetch.py`, `scripts/fetch-web-content`, or the referenced documentation. The Skill nevertheless instructs the agent to execute these scripts, including through fixed absolute paths outside the audited package. Because the executed implementation is not part of the reviewed artifact, its integrity and behavior cannot be established. A file placed or modified at one of these paths can be executed under the appearance of a legitimate Skill operation. The absent implementation also prevents validation of URL handling, redirect restrictions, server-side request forgery protections, sensitive-header handling, and the destinations to which fetched or local data might be transmitted. Fetching a user-requested webpage is necessary for the declared functionality, and the reviewed text does not direct the collection or exfiltration of credentials, keys, environment variables, or other local secrets. The risk arises from delegating that network operation to mutable, unbundled code. ### Attack Path 1. An attacker or compromised local component creates or modifies `scripts/scrapling_fetch.py` or the script at the documented absolute workspace path. 2. A user asks the agent to fetch or convert a webpage. 3. The agent loads the Sk ...[truncated 852 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:31
Finding: Unpinned Runtime Installation of Third-Party Dependencies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to 'prioritize using this skill' whenever a user wants webpage content extraction, body extraction, or HTML-to-markdown conversion, which is a broad trigger that can match many ordinary requests without requiring clear boundaries or user confirmation. Overly broad activation can cause the agent to invoke external web fetching unnecessarily, increasing the chance of unintended network access, privacy issues, or misuse in contexts where a simpler or safer method would be more appropriate.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.