ClawHub
Back to skill

Security audit

Competitor Parser

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its competitor-scraping purpose, but it relies on an unbundled local script and includes a hard-coded Telegram recipient for sending the generated report.

Review this skill before installing. Only run it if you trust the local competitors_scraper.py at the referenced workspace path, replace the Telegram target with a recipient you control, confirm before sending any report externally, and avoid the sudo browser-install command unless an administrator intentionally approves that host change.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:198
Finding

Hard-Coded Telegram Recipient Can Cause Unauthorized Data Disclosure

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 198–201
Vulnerability Type: Hard-coded outbound data destination
Risk Level: High

Vulnerable Code

bash
openclaw message send --channel telegram \
  --target "652766550" \
  --message "📊 Отчёт по конкурентам" \
  --media "/home/larthe/.openclaw/workspace/competitors_data.csv"

Technical Analysis

The documented command sends the generated competitor report to the fixed Telegram recipient 652766550. The project provides no evidence that this recipient belongs to the user or is authorized to receive the report.

Because the recipient is embedded directly in the Skill instructions, an agent following the documented integration procedure may transmit locally generated business data without requiring the user to specify or verify the destination. The issue is an insecure configuration practice involving a hard-coded external data recipient.

Attack Path

  1. A user asks the agent to send the competitor report through Telegram.
  2. The agent follows the command documented in SKILL.md.
  3. The command attaches /home/larthe/.openclaw/workspace/competitors_data.csv.
  4. The report is sent to the fixed Telegram account 652766550.
  5. If that account is not controlled by the user, the recipient gains unauthorized access to the report.

Impact Assessment

Successful exploitation can disclose the complete generated CSV report to an unintended third party. Based on the documented output fields, the disclosed information may include competitor names, addresses, websites, telephone numbers, prices, ratings, social-media references, notes, sources, and collection dates.

This finding does not grant local system privileges, but it crosses the local trust boundary and may expose business intelligence through an external messaging service.

Remediation
View remediation

Remediation Suggestions

  • Remove the hard-coded Telegram recipient from the Skill.
  • Require the recipient identifier to be supplied explicitly by the user at execution time.
  • Display the destination, attachment path, and message contents before transmission.
  • Require explicit confirmation immediately before sending the file.
  • Validate the destination against an administrator- or user-approved allowlist where appropriate.
  • Avoid storing personal recipient identifiers in publicly distributed Skill documentation.
  • Record outbound transmission metadata in an audit log without recording sensitive report contents.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:11
Finding

Execution of an Unbundled and Unverified External Workspace Script

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–12
Additional Occurrences: SKILL.md, lines 46–47 and line 187
Vulnerability Type: Unsafe execution of mutable external code
Risk Level: High

Vulnerable Code

bash
cd /home/larthe/.openclaw/workspace && python3 competitors_scraper.py

Technical Analysis

The audited project contains only SKILL.md. The referenced competitors_scraper.py file is not included in the Skill package, even though it implements the Skill's principal behavior.

The command changes into /home/larthe/.openclaw/workspace and executes whichever file is present there under the expected name. Consequently, the executed code is outside the reviewed package, is not integrity-checked, and may be modified independently after the Skill is installed or audited.

This creates a local code-substitution risk. Any process or user capable of writing to the external workspace could place or replace competitors_scraper.py. The next Skill invocation would execute that code with the privileges of the agent process.

Attack Path

  1. An attacker or compromised process obtains write access to /home/larthe/.openclaw/workspace.
  2. The attacker creates or replaces competitors_scraper.py with arbitrary Python code.
  3. A user invokes the competitor-parsing Skill.
  4. The agent follows the documented command and changes into the external workspace.
  5. Python resolves and executes the attacker-controlled competitors_scraper.py.
  6. The substituted script performs actions allowed by the agent's operating-system account.

Impact Assessment

Exploitation can provide arbitrary code execution with the privileges of the account running the agent. Depending on that account's permissions, the substituted script could read or modify workspace files, access locally available credentials or environment variables, make network requests, alter generated reports, or exf ...[truncated 210 chars]

Remediation
View remediation

Remediation Suggestions

  • Include competitors_scraper.py inside the audited Skill package.
  • Resolve the script path relative to the immutable Skill installation directory rather than a general-purpose workspace.
  • Refuse execution if the expected script is absent.
  • Verify the script against a cryptographic digest or signed manifest before execution.
  • Ensure that untrusted users and unrelated processes cannot modify packaged executable files.
  • Run the scraper under a dedicated, least-privileged account or sandbox.
  • Restrict filesystem and network access to resources required for competitor-data collection.
  • Include all supporting code and dependencies in future audits so the Skill's effective behavior can be reviewed.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:139
Finding

Unattended System-Wide Browser Installation Using Elevated Privileges

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 139
Vulnerability Type: Excessive privilege use and unsafe system modification
Risk Level: Medium

Vulnerable Code

bash
sudo apt-get install -y chromium chromium-driver

Technical Analysis

The Skill recommends using sudo to install Chromium and its driver globally. The -y option automatically accepts package-manager prompts, reducing the opportunity to review the packages and system changes before installation.

This instruction crosses the normal privilege boundary of an application-level scraping task and modifies protected host state. The document already describes a fallback based on built-in competitor data, so privileged package installation is not strictly necessary for basic operation.

The project also does not pin package versions, document repository trust assumptions, or provide an isolated execution environment. Although the command names legitimate packages and there is no evidence of dependency confusion in the audited file, privileged installation unnecessarily broadens the impact of repository compromise, package substitution, or configuration errors.

Attack Path

  1. Direct parsing fails or a user requests full browser-based parsing.
  2. The agent follows the documented remediation command.
  3. The agent invokes sudo and obtains authorization to run the package manager as root.
  4. apt-get installs packages and dependencies system-wide without interactive confirmation.
  5. Any unsafe package source, compromised package, or unintended dependency receives the installation privileges available to the system package manager.

Impact Assessment

The direct impact is an administrator-authorized, system-wide modification of the host. Installed packages and their installation scripts can affect protected directories and system configuration with root privileges.

No privilege-bypass mechanism or malicious package is ...[truncated 288 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not execute privileged installation commands automatically.
  • Require explicit, informed administrator approval before any system-wide installation.
  • Prefer an existing browser installation or a user-scoped, isolated runtime.
  • Use a container or sandbox with narrowly scoped filesystem and network permissions.
  • Pin tested browser and driver versions where reproducibility is required.
  • Verify that packages originate from trusted, configured repositories.
  • Remove -y when administrator review of package-manager changes is appropriate.
  • Preserve the non-browser fallback so the Skill can operate without elevated privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The Telegram example sends a local report file to a fixed external recipient ID, which creates a clear exfiltration path for locally generated data. Because the recipient is hard-coded and no warning or confirmation step is shown, a user or agent could inadvertently disclose internal data to an unintended third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation presents the scraper as a quick-start action and lists external sources and output artifacts, but it does not prominently warn that execution will perform external HTTP collection and generate local files. In an autonomous or semi-autonomous agent environment, that lack of disclosure can lead to unexpected network activity, scraping of third-party services, and unintended persistence of collected data.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
86% confidence
Finding

The skill instructs use of 'sudo apt-get install', encouraging privileged system modification as part of normal operation. In agent-assisted environments, root-level package installation expands the blast radius of mistakes, can change host state unexpectedly, and may normalize privilege escalation without necessity checks.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

Для полного парсинга:

bash
sudo apt-get install -y chromium chromium-driver

Затем в скрипте:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill states that data is updated automatically 'on user request' without defining which requests should trigger scraping. In an agent context, this broad activation can cause unintended execution of networked data collection and local file writes from ambiguous prompts, increasing the chance of accidental external access and side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The natural-language content of the skill file is entirely Russian, including headings, instructions, and examples, with no indication that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in can be a policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.