ClawHub
Back to skill

Security audit

ImmoScout24 Search

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed ImmoScout24 search helper, but it deliberately bypasses anti-bot controls and includes unsafe dependency installation instructions.

Review carefully before installing. Use an isolated virtual environment, avoid the --break-system-packages command, confirm the dependency actually needed, and only run this if you are comfortable with automated access to ImmoScout24's mobile API and the stated anti-bot bypass behavior.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unnecessary Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–17
Vulnerability Type: Unpinned and unnecessary third-party dependency installed outside an isolated environment
Risk Level: Medium

Vulnerable Code Snippet:

markdown
Requires `immoscout` Python package:
```bash
pip3 install --break-system-packages immoscout
text

### Technical Analysis

The installation instructions direct users to install the latest available version of the `immoscout` package without a version constraint or integrity hash. This leaves package selection dependent on the mutable state of the package repository and prevents verification that reviewed dependency artifacts are the ones installed.

The command also uses `--break-system-packages`, which bypasses Python's externally managed environment safeguard and permits pip to modify an operating-system-managed Python environment. This can overwrite or conflict with packages expected by other applications on the host.

The dependency is unnecessary for the supplied implementation: `scripts/immoscout24-search.py` imports `argparse`, `json`, `sys`, `uuid`, and `requests`, but never imports or invokes `immoscout`. Consequently, following the documented prerequisite expands the software supply-chain attack surface without supporting the skill's declared functionality. The actually used third-party dependency, `requests`, is not declared by these instructions.

### Attack Path

1. A user follows the prerequisite documented in `SKILL.md`.
2. pip queries its configured package index and resolves the current unpinned `immoscout` release and its transitive dependencies.
3. A compromised, malicious, or unexpectedly changed package artifact is downloaded.
4. Package build or installation hooks execute with the invoking user's privileges.
5. Because installation is allowed in the externally managed Python environment, the package may introduce attacker-controlled code or modify dependen
...[truncated 953 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the immoscout installation prerequisite because the supplied script does not use that package.
  2. Explicitly declare the actual third-party dependency, requests, in a dependency manifest such as requirements.txt or pyproject.toml.
  3. Pin dependencies to reviewed versions and use a lockfile with cryptographic hashes where supported.
  4. Install dependencies in a dedicated virtual environment rather than passing --break-system-packages.
  5. Review and pin transitive dependencies, and use automated dependency vulnerability and provenance scanning.
  6. Update the documentation with an isolated installation procedure, for example:
bash
python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises and relies on networked access to a third-party API, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, this can cause the skill to be invoked with broader-than-expected network/MCP capabilities, reducing reviewability and increasing the chance of unauthorized external access or misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text is broad enough to activate on common German real-estate queries, which can cause this skill to run in situations where the user did not specifically request this particular integration. Because the skill performs third-party network access and is designed to bypass anti-bot protections, overbroad invocation materially increases the chance of unintended external requests and policy-violating use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly claims it 'bypasses anti-bot/DataDome protection' and accesses a third-party mobile API, yet it provides no user-facing warning or consent boundary around that behavior. This is dangerous because it normalizes evasion of access controls and may lead users or agents to interact with a service in ways that violate terms, trigger blocking, or create legal/compliance exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/immoscout24-search.py (reported line 48)May include surrounding context.

python
params['numberofrooms'] = f'{min_rooms}-'

        resp = session.post(
            'https://api.mobile.immobilienscout24.de/search/list',
            params=params,
            json={'supportedREsultListType': [], 'userData': {}}
        )

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/immoscout24-search.py (reported line 87)May include surrounding context.

python
params['numberofrooms'] = f'{min_rooms}-'

        resp = session.post(
            'https://api.mobile.immobilienscout24.de/search/list',
            params=params,
            json={'supportedREsultListType': [], 'userData': {}}
        )

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code hard-codes the HTTP header Accept-Language: de-DE, which forces a specific locale for all requests. This is a natural-language/locale policy concern because users are not offered a language choice and the file does not document why this locale restriction is required.

Content

No source excerpt is available for this finding.