ClawHub
Back to skill

Security audit

deep-scraper

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed browser-based web scraping skill with broad but purpose-aligned behavior and no evidence of hidden exfiltration, persistence, or destructive actions.

Install only if you need a broad scraping tool and are comfortable running Docker/browser automation from your machine. Use it only on public or explicitly authorized URLs, avoid logged-in, private, internal, or sensitive pages, and remember that scraped text may appear in terminal or agent logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The code performs browser-driven scraping of arbitrary URLs and extracts page body text or YouTube transcript data without any built-in allowlist, consent check, or user-facing notice about what content will be collected. In an agent-skill context, this increases the risk of unauthorized collection of sensitive or copyrighted data and makes misuse easier if the skill is pointed at internal or private resources.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal