ClawHub
Back to skill

Security audit

webfetch

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent web-fetch helper, but it under-discloses risky TLS bypass use and recommends an unpinned global npm install.

Review this skill before installing. It may be useful for page-to-Markdown fetching, but avoid using `--insecure` for sensitive or trusted sites, and prefer a pinned, reviewed, project-local installation of the webfetch package instead of a global latest-version npm install.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:82
Finding

Unpinned Third-Party Package Installed Globally

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82–88
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Vulnerable Code

sh
command -v webfetch

If it is not installed, execute:

sh
npm install -g @lyhue1991/webfetch

Technical Analysis

The Skill instructs the Agent to install @lyhue1991/webfetch globally without specifying an exact reviewed version, integrity hash, lockfile, or provenance verification. npm will therefore resolve the package version from the registry at installation time.

Because npm packages can contain lifecycle scripts that execute during installation, a compromised package account, malicious future release, or compromised registry response could cause arbitrary code to run under the identity performing the installation. Global installation also makes the package available outside this individual project and can modify globally accessible executables.

The reviewed project does not include evidence that the named dependency is currently malicious. The vulnerability is the unsafe dependency acquisition and installation process.

Attack Path

  1. The Agent checks for webfetch and determines that it is not installed.
  2. The Agent follows the Skill instructions and runs npm install -g @lyhue1991/webfetch.
  3. npm resolves the current package release dynamically because no exact version or integrity value is specified.
  4. An attacker who has compromised the package, publisher account, or distribution channel provides a malicious release.
  5. Malicious lifecycle scripts can execute during installation, or malicious package logic can execute when the Agent subsequently invokes webfetch.
  6. The payload runs with the permissions of the installing or invoking user.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the privileges of the user running npm or webfetch. ...[truncated 493 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact, reviewed version rather than resolving the latest release dynamically.
  2. Record and verify the expected package integrity hash and publisher provenance.
  3. Use a lockfile and a trusted npm registry configuration.
  4. Prefer a project-local, isolated installation over npm install -g.
  5. Run the package with a dedicated low-privilege account or in a restricted container.
  6. Disable lifecycle scripts during installation where compatible, for example with npm install --ignore-scripts, and separately review any scripts that are required.
  7. Review the package source, transitive dependencies, ownership history, and release artifacts before approving it.
  8. Document a known-good version and controlled upgrade process.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:55
Finding

TLS Certificate Verification Can Be Disabled During Web Fetching

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55–60; also referenced at lines 136, 147–150, and 182–185
Vulnerability Type: TLS certificate validation bypass
Risk Level: Medium

Vulnerable Code

sh
webfetch "https://example.com" --insecure

The Skill also recommends this option when proxy certificate errors occur:

text
Proxy certificate issue — if a certificate error occurs while using a proxy, add the `--insecure` parameter.

Technical Analysis

The --insecure option disables TLS certificate verification. TLS encryption without certificate authentication does not reliably establish the identity of the remote server.

The Skill presents this option as a general response to certificate or proxy errors without requiring explicit user approval, restricting it to an isolated test environment, or warning against its use with credentials and sensitive data. This can convert a detectable trust-configuration failure into a connection that silently accepts an attacker-controlled certificate.

The fetched content may be displayed to the Agent, converted into Markdown, or saved to a file. Consequently, a network attacker could modify the content consumed by downstream users or automated processes.

Attack Path

  1. The Agent attempts to fetch an HTTPS URL and encounters a certificate validation error.
  2. Following the Skill instructions, the Agent retries the request with --insecure.
  3. An attacker controlling a network segment, DNS response, gateway, or untrusted proxy intercepts the connection.
  4. The attacker presents an untrusted certificate and impersonates the destination.
  5. Because certificate verification is disabled, webfetch accepts the connection.
  6. The attacker observes or modifies HTTP traffic and returns forged page content.
  7. The forged content is presented as the requested page or written to an output file, potentially influencing downstream processing.

...[truncated 545 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove --insecure from normal troubleshooting instructions and examples.
  2. Resolve certificate failures by installing the correct trusted CA certificate or configuring the approved proxy CA bundle.
  3. Verify the destination hostname, certificate chain, validity period, and trust store before retrying.
  4. If insecure mode must remain available for isolated diagnostics, require explicit user authorization for each use.
  5. Restrict insecure mode to non-production test systems and prohibit credentials, tokens, cookies, personal information, and other sensitive data.
  6. Display a prominent warning that server identity will not be authenticated.
  7. Prevent content retrieved through insecure mode from being automatically executed or treated as trusted instructions.
  8. Record insecure fetches in audit logs, including the destination and reason for bypassing validation, without logging secrets.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly recommends --insecure to bypass TLS certificate validation when certificate errors occur, but it does not warn that this disables server authenticity checks and enables man-in-the-middle interception. In a web-fetching skill that may retrieve arbitrary user-requested URLs, normalizing this workaround makes it more likely operators will fetch sensitive or trusted content over an unauthenticated TLS channel.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.