ClawHub
Back to skill

Security audit

SaaS (Screenshot As A Service)

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it can send sensitive cookies or headers to a third-party screenshot service without strong warnings.

Review carefully before installing. Use it only for public or intentionally shareable URLs unless you explicitly trust the screenshot provider. Do not send login cookies, Authorization headers, API keys, internal-only URLs, or private pages through this service unless the credentials are short-lived, narrowly scoped, and safe to expose to that provider.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:52
Finding

Sensitive Authentication Data May Be Disclosed to a Third-Party Screenshot Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:52-53
Vulnerability Type: Sensitive Credential Disclosure Risk
Risk Level: Medium

Vulnerable Code Snippet:

markdown
| `cookies` | array | — | Array of `{name, value, domain}` objects |
| `headers` | object | — | Custom HTTP headers |

Technical Analysis

The skill allows cookies and arbitrary HTTP headers to be submitted to the externally operated screenshot service at https://snap.llm.kaveenk.com. These fields may contain session cookies, bearer tokens, API credentials, CSRF tokens, or other private request metadata.

The documentation does not warn users that these values leave the local environment, require explicit approval before transmitting them, prohibit long-lived credentials, or describe the service's logging and retention practices. The remote service must receive these credentials to use them when loading the requested page. Consequently, the service operator, service-side logs, or an attacker who compromises the service could potentially obtain reusable authentication material.

Attack Path

  1. A user or agent requests a screenshot of content that requires authentication.
  2. The agent supplies session cookies or an authorization header through the documented cookies or headers options.
  3. The request, including the authentication material, is transmitted to snap.llm.kaveenk.com.
  4. The third-party service processes the credentials and may expose them through application logs, monitoring systems, operational access, or a service compromise.
  5. If the credentials remain valid and are not appropriately scoped, a party that obtains them may replay them against the target service.

Impact Assessment

The attainable privileges depend on the transmitted credentials. Exposure of a valid session cookie or authorization token could permit access equivalent to the affected user's authenticated session, including viewing private ...[truncated 397 chars]

Remediation
View remediation

Remediation Suggestions

  • Add a prominent warning that cookies and custom headers are transmitted to and processed by a third-party service.
  • Require explicit user confirmation before sending any cookie, authorization header, API key, or other potentially sensitive value.
  • Reject or redact sensitive headers such as Authorization, Cookie, Proxy-Authorization, and provider-specific API-key headers by default.
  • Prefer short-lived, narrowly scoped credentials created specifically for screenshot access rather than primary account sessions or long-lived tokens.
  • Implement an allowlist for permitted header names and cookie domains.
  • Prevent credentials from being sent to domains other than the intended screenshot target, including across redirects.
  • Document encryption in transit, server-side access controls, credential logging behavior, retention periods, deletion procedures, and incident-response practices.
  • Ensure request bodies and headers containing secrets are excluded from application, proxy, analytics, and error logs.
  • Advise users to revoke credentials immediately if they are transmitted unintentionally.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill routes user-supplied URLs to an external screenshot service and also supports forwarding cookies and custom headers, but the main description does not prominently warn users that this data leaves the local environment. That can expose internal URLs, session material, or other sensitive request metadata to a third-party service, especially when used by an autonomous agent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

Step 1: Register for an API key

bash
curl -s -X POST https://snap.llm.kaveenk.com/api/register \
  -H "Content-Type: application/json" \
  -d '{"name":"my-agent"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

Example with all options

bash
curl -s -X POST https://snap.llm.kaveenk.com/api/screenshot \
  -H "Authorization: Bearer snap_yourkey" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
API = "https://snap.llm.kaveenk.com"

# Register (one-time)
r = requests.post(f"{API}/api/register", json={"name": "my-agent"})
key = r.json()["key"]

# Screenshot

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md
key = r.json()["key"]

# Screenshot
r = requests.post(f"{API}/api/screenshot",
    headers={"Authorization": f"Bearer {key}"},
    json={"url": "https://example.com", "full_page": True})
with open("shot.png", "wb") as f:

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The registration flow creates an API key and shows it in examples, but the main usage path does not strongly emphasize credential handling before the user is encouraged to use the service. While there is a brief note to store the key securely, the skill lacks stronger guidance against logging, embedding, or exposing the key in agent traces or shared outputs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.