ClawHub
Back to skill

Security audit

AI Content Repurposer Pro

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its content-repurposing purpose, but it needs review because arbitrary URL fetching and batch output writes are not safely bounded.

Review before installing in environments that can reach private networks or sensitive internal sites. Do not feed confidential, regulated, or proprietary content unless you are comfortable sending it to OpenAI, avoid processing untrusted URLs, and treat batch config files as trusted input until URL validation, privacy disclosure, dependency updates, and output-path containment are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
src/converter.js:219
Finding

Unrestricted Blog URL Fetching Enables Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
bin/cli.js:276
Finding

Batch Job Name Path Traversal Allows Writes Outside the Output Directory

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
97% confidence
Finding

The lockfile pins axios to 1.13.6, which the static analysis reports as having multiple published advisories including SSRF-related proxy bypass and prototype-pollution-assisted request/response compromise issues. In a skill that repurposes content and likely fetches remote URLs, a vulnerable HTTP client materially increases risk because attacker-controlled URLs, redirects, proxy settings, or crafted objects may influence outbound requests and expose internal services, credentials, or response integrity.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
90% confidence
Finding

form-data 4.0.5 is reported vulnerable to CRLF injection via unescaped multipart field names and filenames. If any part of this skill constructs multipart requests from untrusted input, an attacker may be able to smuggle or alter HTTP message structure, potentially affecting downstream services or enabling request manipulation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.24.3 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High
Category
Supply Chain
Confidence
92% confidence
Finding

undici 7.24.3 is flagged with multiple HTTP parsing, queue poisoning, and desynchronization-related advisories. Because cheerio depends on undici and this skill likely retrieves remote web content, these issues can affect the integrity and isolation of HTTP responses, potentially causing information disclosure, response mix-ups, or denial of service when interacting with malicious endpoints.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
95% confidence
Finding

The skill declares axios with a broad range (^1.6.0), and the analysis indicates resolution to axios 1.13.6 with multiple published advisories, including SSRF-related and prototype-pollution-assisted attack paths. Because this skill is described as transforming external content and includes web-fetching libraries, a vulnerable HTTP client is more dangerous in context: attacker-controlled URLs, proxy behavior, redirects, or crafted responses could be leveraged to exfiltrate data, bypass network restrictions, or hijack request handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The quick start encourages URL-based blog conversion without warning that the tool may retrieve webpage content and, when AI features are enabled, potentially transmit that content to an external model provider. This can lead users to process private, internal, or copyrighted material without understanding the data exposure implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README advertises commands that accept URLs and use AI features backed by an OpenAI API key, but it does not warn users that fetched content and user-supplied text may be transmitted to external services. This creates a real privacy and data-handling risk because users may unknowingly submit proprietary, personal, or sensitive content to third-party infrastructure over the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly requires an OpenAI API key and describes AI-powered transformations, but it does not clearly warn users that their provided transcripts, blog contents, URLs, or files may be transmitted to an external AI service for processing. This can lead users to unknowingly send sensitive, proprietary, or personal content off-platform, creating privacy, compliance, and confidentiality risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The CLI accepts a user-supplied URL and fetches its contents without any explicit warning that the provided URL and resulting network request may disclose information to external services. In a local CLI context this is not code execution, but it can still create privacy and data-handling risks because users may unintentionally send internal, sensitive, or authenticated URLs across the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This command also fetches content from a user-provided URL without prominently informing the user that remote network access will occur. That omission can lead to accidental privacy exposure or retrieval of sensitive internal resources if a user supplies a URL they did not realize would be fetched by the tool.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/converter.js (reported line 13)May include surrounding context.

js
constructor(options = {}) {
    this.apiKey = options.apiKey || process.env.OPENAI_API_KEY;
    this.model = options.model || 'gpt-4';
    this.baseUrl = 'https://api.openai.com/v1';
  }

  /**

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The module documentation describes a 'Core Converter' that transforms provided content into other formats, but this method adds a separate capability to fetch and scrape arbitrary blog URLs over the network. With no manifest available to justify broader acquisition capabilities, remote content retrieval is not clearly necessary for a converter whose other methods operate on caller-supplied text.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Content fetched from arbitrary blog URLs is later embedded into prompts and sent to the external OpenAI API without any explicit user consent, warning, or data-classification check at the transmission point. This creates a privacy and data-handling risk because scraped content may contain copyrighted, private, or sensitive material that users do not realize will be forwarded to a third party.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low
Category
Supply Chain
Confidence
88% confidence
Finding

follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. If this skill sends authenticated requests while scraping or fetching content, an attacker-controlled redirect could cause bearer tokens or other sensitive headers to be forwarded to an unintended host.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json
"author": "OpenClaw",
  "license": "MIT",
  "dependencies": {
    "commander": "^11.0.0",
    "axios": "^1.6.0",
    "cheerio": "^1.0.0-rc.12"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "commander": "^11.0.0",
    "axios": "^1.6.0",
    "cheerio": "^1.0.0-rc.12"
  },
  "engines": {