Web Crawling API

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:06 AM UTC
• Version: 1.0.2

Overview

This appears to be a legitimate web-crawling helper, with privacy and API-key handling precautions users should understand before use.

Install only if you are comfortable sending crawl targets and fetched page processing to Just Serp API. Use it for public pages, avoid URLs containing secrets or private/internal resources, and prefer a version that reads JUST_SERP_API_KEY directly from the environment rather than passing the key on the command line.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:41

Finding

API Key Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:41; supporting implementation in bin/run.mjs:129-131 and bin/run.mjs:156-158
Vulnerability Type: API credential exposure through the process argument vector
Risk Level: Medium

Vulnerable Code

SKILL.md:41:

bash

node {baseDir}/bin/run.mjs --operation "<operation-id>" --api-key "$JUST_SERP_API_KEY" --params-json '{"key":"value"}'

bin/run.mjs:129-131:

js

if (!args.apiKey) {
  fail("Missing required --api-key argument.");
}

bin/run.mjs:156-158:

js

const requestInit = {
  headers: {
    "accept": "application/json",
    "X-API-Key": args.apiKey,
  },
  method: operation.method,
};

The argument parser also explicitly accepts the credential through --api-key:

js

if (flag === "--api-key") {
  parsed.apiKey = value;
  index += 1;
  continue;
}

Technical Analysis

The documented command expands JUST_SERP_API_KEY into the child process argument vector. Command-line arguments may be accessible to other local users or administrative monitoring components through process inspection interfaces, audit records, endpoint telemetry, shell tracing, diagnostic tooling, or process listings.

Authentication to the declared Just Serp API is necessary for the Skill's functionality, and transmitting the key in an X-API-Key header over the hard-coded HTTPS endpoint is consistent with that purpose. However, passing the credential through a command-line argument is not necessary and exceeds the minimum exposure required. The script can read process.env.JUST_SERP_API_KEY directly without placing the secret in its argument vector.

No evidence was found that the script deliberately prints the API key or transmits it to an undeclared host. The vulnerability is the avoidable local exposure created before the authenticated HTTPS request is made.

Attack Path

1. A victim configures `JUST ...[truncated 1184 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key command-line option from both the documentation and argument parser.

2. Read the credential directly from the process environment:

   js

   const apiKey = process.env.JUST_SERP_API_KEY;
   if (!apiKey) {
     fail("Missing required JUST_SERP_API_KEY environment variable.");
   }
   

3. Construct the authentication header using the environment-derived value:

   js

   const requestInit = {
     headers: {
       accept: "application/json",
       "X-API-Key": apiKey,
     },
     method: operation.method,
   };
   

4. Update the documented invocation so the secret is not expanded into an argument:

   bash

   node {baseDir}/bin/run.mjs --operation "<operation-id>" --params-json '{"key":"value"}'
   

5. As an alternative where environment variables are unsuitable, accept the secret through protected standard input or an operating-system credential store.

6. Keep the key out of error payloads, logs, debug traces, telemetry, and shell tracing.

7. Rotate any API key that may previously have been captured in process telemetry or audit logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

- Project site: [Just Serp API](https://justserpapi.com/?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justserpapi_web&utm_content=project_link).
- Authentication details: [Just Serp API Docs](https://docs.justserpapi.com/?utm_source=clawhub.ai&utm_medium=referral&utm_campaign=justserpapi_web&utm_content=project_link).

## Output Rules

- Start with what was fetched: raw HTML, rendered HTML, or cleaned Markdown.
- Echo the target URL so the crawl scope is explicit.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes a Node helper that performs outbound web requests, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates a policy/visibility gap: a reviewer or host may not realize the skill has network-capable behavior, which can weaken sandboxing and approval decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This skill accepts an arbitrary user-supplied URL and transmits it to the external Just Serp API, which creates a clear data-flow of user input to a third party without any explicit warning, consent mechanism, or restriction. Even if intended functionality is web crawling, users may supply sensitive or internal URLs, causing inadvertent disclosure of browsing targets, internal hostnames, query secrets, or other confidential URL data to the vendor.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is explicitly designed to send user-supplied URLs to a third-party crawling service, but the manifest provides no warning, consent mechanism, or policy guardrails about that external transmission. This can expose sensitive or internal URLs, leak browsing targets to the provider, and enable indirect access attempts against internal or private resources if downstream validation is weak.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The endpoint accepts a user-supplied URL and sends it to an external crawling service, but the documentation provides no warning that user input will be transmitted off-platform and that full page content may be retrieved and returned. This can cause users or downstream agents to unintentionally disclose sensitive internal URLs, query tokens, or private resources to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown crawling operation retrieves remote webpage content through an external provider and transforms it for LLM-friendly use, yet it omits any disclosure about external transmission and content acquisition. That increases the risk of accidental exfiltration of confidential URLs or ingestion of sensitive third-party content into downstream AI workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The rendered HTML endpoint is especially sensitive because it can fetch and return full rendered page content, potentially including dynamically loaded data, while giving no warning about third-party transmission. In an agent context, this makes accidental disclosure and over-collection more dangerous because users may not realize a remote service is rendering and extracting the target page.

Content

No source excerpt is available for this finding.