Web Scraper Pro

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:24 AM UTC
• Version: 1.1.0

Overview

This is a straightforward web-scraping skill with expected web access, export, and scheduling features, but users should review install and scraping scope before using it.

Before installing, prefer a pinned and trusted clawhub installer version if available. Use the scraper only on sites and APIs you are authorized to access, review robots.txt and rate limits, verify where exports and downloaded images are stored, and check how scheduled jobs can be listed and removed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:5

Finding

Unpinned Package Execution Through a Mutable Release Tag

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 5–7
Vulnerability Type: Supply-chain risk caused by executing an unpinned third-party package
Risk Level: Medium

Vulnerable Code Snippet:

bash

npx clawhub@latest install web-scraper-pro

Technical Analysis

The documented installation command instructs users to execute clawhub through npx using the mutable latest tag. If the package is not already available locally, npx can retrieve it from the configured package registry and execute it immediately.

Because latest does not identify an immutable, reviewed release, the code executed by this command may change after the skill has been audited. The repository provides no exact version pin, package integrity hash, lockfile, or other mechanism for verifying that users execute the same package version reviewed by the publisher.

This creates a supply-chain exposure: compromise of the package publisher account, registry entry, release process, or mutable tag could cause the installation command to retrieve and run attacker-controlled code.

Attack Path

1. An attacker compromises the clawhub package publication process, its publisher account, or the corresponding registry entry.
2. The attacker publishes a malicious release and assigns it to the latest distribution tag.
3. A user follows the installation instructions in README.md.
4. npx retrieves the package version currently referenced by latest.
5. The retrieved package executes with the privileges of the user who invoked the command.
6. The malicious package can perform actions available to that user, such as reading accessible files, modifying user-owned data, making network requests, or installing additional user-level components.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user running the installation command. The affected scope may include that use ...[truncated 535 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an exact, reviewed package version, for example:

   bash

   npx clawhub@<reviewed-exact-version> install web-scraper-pro
   

2. Publish and verify the expected package integrity digest or signature before execution.

3. Document the trusted package registry explicitly to reduce registry substitution or dependency-confusion risks.

4. Use a lockfile or equivalent immutable dependency manifest where installation tooling supports it.

5. Review each package update before changing the documented version, and use protected publishing credentials with multi-factor authentication.

6. Advise users not to run the installation command with administrator or root privileges unless strictly required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command uses npx clawhub@latest, which pulls and executes the newest published package version at install time rather than a reviewed, fixed version. If the upstream package is compromised, typosquatted, or publishes a malicious update, users of this skill could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes capabilities that can affect user data, privacy, or external systems, including scheduled collection and exporting scraped data, but it provides no user-facing warning or limitations. Under the markdown-specific SQP-2 criteria, skills with behaviors that may affect privacy or system integrity should disclose those risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README presents the skill description entirely in Chinese ('网页数据抓取工具。') without indicating that language choice is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The description and all user-facing documentation are presented only in Chinese, with no indication that users can choose another language or that the locale restriction is intentional and justified. This matches the policy concern for language/locale constraints without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.