ClawHub
Back to skill

Security audit

Full Webpage Screenshot

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it claims: install Puppeteer, visit a user-provided webpage, scroll it, and save a screenshot locally.

Install only if you are comfortable with npm/Puppeteer dependencies and a headless browser opening the URLs you request. Avoid sensitive internal, confidential, or authenticated pages unless you intend to disclose normal browsing metadata to the target site and capture the page contents locally; choose output paths carefully because screenshot files may overwrite existing files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
93% confidence
Finding
This skill causes the agent to visit arbitrary third-party URLs in a browser context, which necessarily discloses the requested URL, IP address, user agent, and related browsing metadata to the remote site and any embedded third-party resources. The documentation does not warn users about this network transmission or the privacy implications, which can matter when users ask to capture sensitive internal, pre-release, or tracking-heavy pages.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal