ClawHub
Back to skill

Security audit

zt-web-fetcher

Security checks for vulnerabilities and agentic risk

Overview

This web-fetching skill is coherent but should be reviewed because it can send full user URLs to multiple third-party services and suggests an unpinned package install fallback.

Install only if you are comfortable using third-party URL conversion services for public web pages. Do not use it for password-reset links, signed download URLs, private documents, internal hosts, localhost, cloud metadata endpoints, or URLs containing tokens or credentials. Require approval and a sandbox before installing Scrapling, and prefer pinned, reviewed dependencies.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:39
Finding

Unpinned Third-Party Package Installation Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–42
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

markdown
## Alternative: Web-Scraping Tool

If all services above fail, try Scrapling:
- Repository: https://github.com/D4Vinci/Scrapling
- Usage: Run `pip install scrapling` before use

Technical Analysis

The skill instructs the agent to install scrapling directly from the Python package index without specifying an audited version, verifying package hashes, or using a lockfile. The dependency version and its transitive dependency graph can therefore change after the skill has been reviewed.

Python package installation can invoke build backends and other package-controlled installation behavior. If the package, one of its dependencies, its distribution account, or the relevant package infrastructure is compromised, installation could execute attacker-controlled code with the privileges of the account running the agent.

The referenced GitHub repository does not protect the actual pip install command because the instruction neither installs a verified commit from that repository nor verifies that the retrieved package corresponds to reviewed source code.

Attack Path

  1. The three URL-conversion services fail to process a requested page.
  2. The agent follows the documented fallback and executes pip install scrapling.
  3. pip resolves the latest compatible package and transitive dependencies from configured package indexes.
  4. A compromised or unexpectedly modified package supplies malicious installation or runtime code.
  5. That code executes during installation or when the scraper is imported and used.
  6. The malicious code gains the same filesystem, network, and process privileges as the account running the installation or scraper.

Impact Assessment

Successful exploitation could result in ...[truncated 354 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin Scrapling and all transitive dependencies to versions that have been reviewed.
  • Use a lockfile and require package hashes, such as pip install --require-hashes -r requirements.txt.
  • Retrieve packages only from explicitly trusted indexes.
  • Perform installation inside a disposable virtual environment or sandbox with minimal filesystem and network permissions.
  • Do not install dependencies automatically. Require explicit user approval before modifying the environment.
  • Prefer packaging the audited dependency set with the skill or using an existing approved scraping tool.
  • Regularly scan pinned dependencies for known vulnerabilities and review changes before upgrading.

other

Warning
Location
SKILL.md:23
Finding

Sensitive Target URLs May Be Disclosed to Multiple External Conversion Services

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–48
Vulnerability Type: Third-party disclosure of complete target URLs
Risk Level: Medium

Complete Code Snippet:

markdown
1. **markdown.new/** (recommended)
   - Usage: Prefix the target URL with `https://markdown.new/`
   - Example: `https://markdown.new/https://example.com`
   - Suitable for websites supported by Cloudflare

2. **r.jina.ai/** (fallback)
   - Usage: Prefix the target URL with `https://r.jina.ai/`
   - Example: `https://r.jina.ai/https://example.com`
   - Broad compatibility

3. **defuddle.md/** (fallback)
   - Usage: Prefix the target URL with `https://defuddle.md/`
   - Example: `https://defuddle.md/https://example.com`

## Usage Process

1. First try `r.jina.ai/{url}`
2. If that fails, try `markdown.new/{url}`
3. If that also fails, try `defuddle.md/{url}`
4. If all fail, consider Scrapling

Technical Analysis

The instructed fetch process embeds the complete target URL into a request sent to an external conversion provider. Complete URLs can contain sensitive query parameters, embedded credentials, signed object-storage tokens, password-reset tokens, private document identifiers, session-related values, or other bearer secrets.

The skill does not require informed user consent, remove sensitive URL components, restrict eligible schemes or destinations, or warn against submitting authenticated and private links. Its sequential fallback also means the same URL may be disclosed to as many as three independent services. Each service may observe and log the URL and may use any bearer authorization contained in it to retrieve the referenced resource.

This finding concerns URL and resource disclosure to third parties. The audited file does not establish that any named service is malicious.

Attack Path

  1. A user asks the agent to inspect a URL containing a sensitive query parameter, signed access toke ...[truncated 950 chars]
Remediation
View remediation

Remediation Suggestions

  • Require explicit user consent before sending a target URL to any third-party conversion service.
  • Detect and reject URLs containing user information, embedded credentials, fragments carrying secrets, or sensitive query parameters.
  • Remove unnecessary tracking and authorization parameters before proxying a URL.
  • Never forward password-reset links, signed download URLs, session URLs, private document links, or other bearer-capability URLs.
  • Prefer a direct, locally controlled fetch mechanism for sensitive resources.
  • Restrict accepted schemes to http and https, and validate destinations before use.
  • Block localhost, link-local, private-network, metadata-service, and other non-public destinations.
  • Clearly identify the selected provider and explain that the complete URL and retrievable content may be visible to it.
  • Avoid automatically sending the same sensitive URL to multiple providers; obtain separate consent before each fallback.
  • Define retention, logging, and privacy requirements for approved conversion providers.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: "00000000000000000000000000000000"
    PropagateID: "00000000000000000000000000000000"
    ReservedCode1: 3044022008ad98e4a61f124b07916990e20c2c86d59d551d839df0b9c207cc26e28b695902200745c5c38a091af93cde3661469ff503f986f8255ed2f490232ffcb22c4ee2cb
    ReservedCode2: 3046022100b4520a31f66e0ffcea18e4aa458fd0b975c7c4016fa890cf411b74c4896469ba022100b83a16d148f9456fe998c67234c2cad311417ee908bd07bbee5d046669534b41
description: |-
    当需要获取网页内容时使用（搜索结果页面、博客文章、文档等）。使用 URL 转 Markdown 服务将网页转换为可读文本。
    触发场景：用户说"帮我查一下"、"看看这个链接"、"获取 xx 的信息"等需要上网抓信息的�

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are very broad (e.g. '帮我查一下', '看看这个链接', '获取 xx 的信息') and overlap with common conversational requests. This can cause the skill to activate in unintended contexts and automatically send user-supplied URLs or browsing targets to external fetch services, increasing the chance of privacy leaks or unsafe network access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs use of third-party URL-to-Markdown services but does not warn that the full target URL and resulting page fetch are delegated to external providers. This creates a data exposure risk because user-provided links, query parameters, signed URLs, or internal endpoints may be disclosed to those services without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.