ClawHub
Back to skill

Security audit

SEO Backlink Submitter

Security checks for vulnerabilities and agentic risk

Overview

This skill can submit website and contact details to third-party directory sites, but it lacks strong review controls and has some misleading or unsafe implementation details.

Review the directory list and any site/contact information before running this skill. Prefer --check-only first, avoid using sensitive personal email addresses, and do not run quick_submit.py without editing its hardcoded data and destinations. Install dependencies in an isolated environment and be aware that submissions may create public or irreversible listings.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/check_directory.py:35
Finding

TLS Certificate Verification Disabled for Directory Checks

Content
View full analysis

Vulnerability Details

File Location: scripts/check_directory.py, line 35
Vulnerability Type: Improper certificate validation
Risk Level: Medium

Vulnerable Code:

python
async with session.get(url, headers=headers, timeout=timeout, ssl=False) as resp:

Technical Analysis

The ssl=False argument disables TLS certificate verification for every HTTPS directory checked by the script. Consequently, the client does not verify that the remote server possesses a valid certificate issued for the requested hostname.

An attacker capable of intercepting or redirecting network traffic could impersonate a directory server using an invalid or attacker-controlled certificate. The script would accept the connection and process the forged HTML response. Because directory classification is based on keywords and HTML form detection, malicious content could cause the script to report fabricated submission, payment, login, or backlink requirements.

This issue affects the integrity and authenticity of directory-checking responses. The reviewed code does not execute content returned by aiohttp, so this flaw alone does not establish arbitrary code execution.

Attack Path

  1. A user invokes scripts/check_directory.py with an HTTPS directory URL.
  2. An attacker gains a network interception or traffic-redirection position, such as through a hostile wireless network, DNS manipulation, or a compromised proxy.
  3. The attacker presents an invalid or attacker-controlled TLS certificate and returns fabricated HTML.
  4. Because certificate validation is disabled, the script accepts the response.
  5. The script analyzes the forged page and produces attacker-influenced directory classification results.

Impact Assessment

The attacker can manipulate the availability and policy classifications generated for checked directories. This may cause users or automated workflows to trust a spoofed service, skip legitimate de ...[truncated 304 chars]

Remediation
View remediation

Remediation Suggestions

Remove ssl=False and retain aiohttp's default certificate and hostname verification:

python
async with session.get(
    url,
    headers=headers,
    timeout=timeout
) as resp:

Additional hardening measures should include:

  1. Use the operating system's trusted certificate store or an explicitly configured trusted CA bundle.
  2. If a private CA is required, create a validated ssl.SSLContext rather than disabling verification globally.
  3. Reject invalid certificates and report the TLS failure clearly without retrying insecurely.
  4. Restrict accepted URL schemes to https and, where practical, validate destinations against an approved allowlist.
  5. Add automated tests confirming that expired, self-signed, hostname-mismatched, and otherwise invalid certificates are rejected.

T08 · Insecure Dependencies

Note
Location
SKILL.md:30
Finding

Unpinned Third-Party Package and Browser Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 30
Vulnerability Type: Unpinned external dependencies and non-reproducible installation
Risk Level: Low

Vulnerable Code:

bash
pip install playwright && playwright install chromium

Technical Analysis

The documented prerequisite installs the latest package version resolved under the name playwright and then downloads a corresponding Chromium artifact. Neither the Python package nor the browser payload is pinned to a reviewed version or protected by a project-supplied integrity hash.

This makes installation behavior non-reproducible and allows upstream changes to alter the code and browser binaries used by the Skill after the Skill itself has been audited. Exploitation requires compromise or malicious modification of a trusted package index, the upstream package release, the browser artifact distribution channel, or the user's dependency-resolution configuration. The audit found no evidence that the package name is typosquatted or that the current upstream dependency is malicious.

Attack Path

  1. A user follows the prerequisite command in SKILL.md.
  2. pip resolves whichever Playwright release is current or selected by the user's configured package index at installation time.
  3. The Playwright installer retrieves a matching Chromium artifact from an external distribution source.
  4. If either resolved artifact or its delivery source has been compromised, attacker-controlled code is installed.
  5. The malicious dependency may execute with the permissions of the user performing installation or when the submission scripts later import and invoke Playwright.

Impact Assessment

A successfully compromised dependency could execute code with the privileges of the installing or invoking user. Depending on those privileges, the potential scope could include access to user-readable files, environment variables, browser data availabl ...[truncated 362 chars]

Remediation
View remediation

Remediation Suggestions

Replace the floating installation instruction with a reproducible dependency process:

  1. Pin Playwright to a specifically reviewed version in requirements.txt, pyproject.toml, or a lock file.
  2. Record and verify package hashes, for example through a hash-locked requirements file and pip install --require-hashes.
  3. Install only from a trusted, explicitly configured package index.
  4. Pin the associated browser revision and document the expected source and integrity-verification procedure.
  5. Perform installation inside an isolated virtual environment or container under a non-privileged account.
  6. Use automated dependency monitoring to identify security advisories and update pins through a reviewed process.
  7. Avoid using sudo or an administrative shell for package and browser installation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

Claiming automatic discovery, free-submission detection, and category-based batch submission while relying on a fixed directory list creates a deceptive operational contract. In security terms, this can lead to unsafe automation assumptions, unintended submissions to unvetted targets, and overbroad trust in external interactions that are not accurately disclosed.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

Claiming automatic discovery, free-submission detection, and category-based batch submission while relying on a fixed directory list creates a deceptive operational contract. In security terms, this can lead to unsafe automation assumptions, unintended submissions to unvetted targets, and overbroad trust in external interactions that are not accurately disclosed.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Claiming automatic discovery, free-submission detection, and category-based batch submission while relying on a fixed directory list creates a deceptive operational contract. In security terms, this can lead to unsafe automation assumptions, unintended submissions to unvetted targets, and overbroad trust in external interactions that are not accurately disclosed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill declares operational behavior that implies network access, local file reads/writes, and browser automation, but it does not define an explicit tool scope or permissions boundary. In an agent environment, missing scope declarations can allow the skill to run with broader-than-necessary capabilities, increasing the blast radius if the skill is misused or if later code is added that performs unsafe actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script automatically submits user-provided site metadata to arbitrary third-party URLs after detecting a form, without an explicit per-run confirmation or clear warning immediately before transmission. In this skill's context, the core purpose is mass submission to external directories, so accidental disclosure of contact information or unintended submissions to untrusted endpoints is materially more dangerous than in a purely local automation script.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script disables TLS certificate verification by passing ssl=False to aiohttp when fetching arbitrary URLs. This allows man-in-the-middle interception or spoofing of HTTPS responses, so the tool may misclassify malicious or tampered pages as valid submission targets; in the context of an automation skill that drives later browser-based submissions, that increases the chance of acting on attacker-controlled content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script automatically clicks submit controls on third-party websites and sends identifying data without any user confirmation, review step, or per-site consent. In this skill’s context, that means the agent can transmit data to external domains and trigger actions on live services, which increases the risk of unintended disclosure, spammy behavior, policy violations, or submissions to deceptive sites.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module title, docstrings, and several inline comments are written in Chinese, which imposes a specific language on users and maintainers without any opt-in or alternative locale. The policy requires avoiding fixed language constraints unless the skill offers choice or clearly documents a justified locale limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The module docstring and function docstring use Chinese text for user- or maintainer-facing descriptions, which can impose a language requirement without opt-in. The file does not indicate that the skill is intentionally region-specific or provide an alternative language choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.