omni-scraper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:54 AM UTC
• Version: 1.0.1

Overview

This skill is a legitimate URL-scraping helper, but it sends URLs and a non-expiring API key to an externally configured endpoint without enough guardrails.

Install only if you are comfortable sending requested URLs, request parameters, and returned page data to the Claw School scraping service. Do not use it for localhost, private network resources, authenticated pages, URLs containing tokens, or sensitive business data unless you have verified the endpoint and data-handling terms. Set CLAW_API_BASE only to the intended trusted HTTPS service and rotate the CLAW_KEY if you suspect it was exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:22

Finding

API Credential Disclosure Through an Unvalidated Endpoint

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-28
Vulnerability Type: Credential exposure through an unvalidated, environment-controlled API endpoint
Risk Level: High

Complete Code Snippet:

bash

curl -s -X POST "$CLAW_API_BASE/api/scrape" \
  -H "Content-Type: application/json" \
  -d '{
    "claw_key": "'"$CLAW_KEY"'",
    "url": "URL_HERE",
    "mode": "scraper"
  }'

Technical Analysis

The Skill instructs the agent to transmit the secret CLAW_KEY in the request body to an endpoint constructed from CLAW_API_BASE. However, the documentation neither defines this variable nor validates its scheme or hostname before transmitting the credential.

Authentication to the declared scraping service is necessary for the Skill's functionality, but allowing an unrestricted environment variable to control the credential's destination exceeds minimum privilege. An attacker who can influence the agent's environment or command context can set CLAW_API_BASE to an attacker-controlled server. The documented command would then disclose both the API credential and the requested target URL.

The curl -s option suppresses progress and error messages, which may reduce the likelihood that a user notices an invalid or unexpected endpoint. The request body also places the key alongside ordinary application data rather than using a conventional authorization header.

Attack Path

1. An attacker or compromised configuration sets CLAW_API_BASE to an attacker-controlled HTTP or HTTPS origin.
2. A user asks the agent to scrape a URL using the Skill.
3. The agent follows the documented command without validating the endpoint.
4. curl sends the CLAW_KEY and requested URL to the attacker-controlled server.
5. The attacker captures the key and reuses it to access the paid scraping service until the credential is revoked or blocked.

Impact Assessment

Successful exploitation expose ...[truncated 635 chars]

Remediation

View remediation

Remediation Suggestions

1. Define and pin the API endpoint to an explicit HTTPS origin controlled by the declared provider rather than relying on an unrestricted environment variable.
2. If endpoint configurability is operationally required, parse and validate the URL before use. Require HTTPS, enforce an exact hostname allowlist, reject embedded credentials, and fail closed for missing or invalid values.
3. Transmit the key through a standard authorization header, such as Authorization: Bearer ..., and ensure the service and intermediary logs redact it.
4. Avoid silent failure during endpoint validation. Provide clear errors when the configured destination is absent or not approved without printing the credential.
5. Warn users not to submit URLs containing credentials, session tokens, private resource identifiers, or other sensitive query parameters.
6. Support prompt credential revocation and rotation after suspected exposure, despite the documented non-expiring nature of the key.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list includes very broad phrases such as "scrape," "crawl," and "fetch page," which are likely to match many ordinary user requests and invoke the skill unexpectedly. Because this skill sends requested URLs to an external scraping service and can retrieve arbitrary remote content, overbroad activation increases the chance of unintended data exfiltration, policy bypass, or unsafe browsing behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to send user-supplied URLs and potentially sensitive page contents to Claw School's external service, but it does not prominently warn users that their data will leave the local agent environment. This creates a transparency and privacy risk because users may provide internal URLs, authenticated endpoints, or sensitive targets without understanding that both the request target and returned content are being transmitted to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The documented curl command performs external transmission of a user-provided URL plus the CLAW_KEY to a third-party API, which is a real security concern in an agent context. While external requests are the core function of the skill, the lack of guardrails around what URLs may be sent means the skill could be used to transmit sensitive internal addresses or scrape protected resources through an untrusted intermediary.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Scrape a URL

bash

curl -s -X POST "$CLAW_API_BASE/api/scrape" \
  -H "Content-Type: application/json" \
  -d '{
    "claw_key": "'"$CLAW_KEY"'",

Static analysis

No suspicious patterns detected.