ClawHub
Back to skill

Security audit

Distil the web & PDFs into markdown

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documentation-only web proxy helper whose network and API-key use are expected for its purpose, though users should be careful about what URLs and queries they send through it.

Install only if you trust Distil or your configured proxy endpoint. Do not use it for secrets, private internal URLs, sensitive query strings, or regulated data unless that proxy is approved. Keep DISTIL_PROXY_URL pinned to a trusted HTTPS endpoint, and choose screenshot output paths deliberately to avoid overwriting or retaining sensitive images.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:24
Finding

Configurable Proxy Endpoint Can Receive the Distil API Key

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:24-33
  • README.md:21-35

Vulnerability Type: Credential disclosure through an unrestricted configurable network endpoint
Risk Level: Medium

Vulnerable Code

SKILL.md:24-33:

bash
1. Get your free API key with email verification from https://distil.net (sign up or use your existing key)
2. Set the `DISTIL_API_KEY` environment variable
3. Optional: set `DISTIL_PROXY_URL` (defaults to `https://proxy.distil.net`)

## Commands

```bash
# Fetch any URL as clean Markdown
curl -s "${DISTIL_PROXY_URL:-https://proxy.distil.net}/https://example.com" \
  -H "X-Distil-Key: $DISTIL_API_KEY"

README.md:21-35:

bash
```bash
export DISTIL_API_KEY=dk_yourkey

Optional:

bash
export DISTIL_PROXY_URL=https://proxy.distil.net

Verify the install

bash
curl -s "${DISTIL_PROXY_URL:-https://proxy.distil.net}/https://example.com" \
  -H "X-Distil-Key: $DISTIL_API_KEY"

Technical Analysis

The documented commands attach the sensitive DISTIL_API_KEY value to an X-Distil-Key HTTP header while deriving the destination from the configurable DISTIL_PROXY_URL environment variable.

Supplying the API key to the default Distil endpoint is necessary for the declared proxy functionality. However, the instructions do not validate the override's scheme or hostname before sending the credential. Consequently, an attacker or unsafe configuration source capable of changing DISTIL_PROXY_URL can redirect authenticated requests to an arbitrary server. The override may also use plaintext HTTP, exposing the key and request metadata to network interception.

The same pattern is used for fetching pages, searching, rendering, screenshots, raw retrieval, and cache bypass. These operations can additionally expose requested URLs and search queries to the selected proxy operator.

Attack Path

  1. An attacker influences t ...[truncated 1271 chars]
Remediation
View remediation

Remediation Suggestions

  1. Use the fixed trusted endpoint https://proxy.distil.net by default and avoid allowing an unrestricted environment variable to determine where credentials are sent.
  2. If self-hosted proxies must be supported, validate DISTIL_PROXY_URL before attaching the API key:
    • Require HTTPS.
    • Reject embedded credentials, unexpected ports, malformed URLs, redirects to untrusted hosts, and non-HTTP schemes.
    • Restrict destinations to an explicit administrator-controlled hostname allowlist.
  3. Separate credentials by endpoint. A self-hosted proxy should use a dedicated key rather than automatically receiving the production Distil API key.
  4. Configure curl to fail safely and constrain redirects. Use options such as --fail-with-body, --proto '=https', and an appropriate redirect policy. Do not forward the authentication header across redirects to an untrusted host.
  5. Document that the proxy receives target URLs, search queries, and related metadata, and warn users not to submit secrets or sensitive internal URLs unless the proxy is trusted.
  6. Rotate DISTIL_API_KEY immediately if it may have been used with an untrusted endpoint, and review account usage for unauthorized requests.
  7. Update both SKILL.md and README.md so their examples and security guidance remain consistent.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README explicitly instructs agents to send arbitrary target URLs and an API-key-authenticated request to an external proxy service, but it does not prominently warn that browsing targets, prompts-derived URLs, and fetched content will leave the local environment. In an agent context, this can cause unintended disclosure of sensitive internal URLs, tokens embedded in URLs, or proprietary browsing targets to a third-party service, especially if the agent is used on private or enterprise data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description advertises only clean Markdown fetching, but the documented commands also support screenshots, rendered browsing, raw-content retrieval, and cache bypass. This mismatch can mislead users or higher-level policy systems about the skill's actual capabilities, reducing informed consent and allowing broader data access than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation does not clearly warn that requested URLs and search queries are transmitted to an external proxy service. In a web-fetching skill, this is especially important because users may send sensitive internal URLs, proprietary documentation links, or confidential search terms, causing unintended third-party disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The screenshot example writes output to a local file, but the skill does not warn about this side effect. In agent environments, undisclosed disk writes can overwrite files, consume storage, or leave behind sensitive artifacts that users did not expect to be persisted.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill claims to fetch pages as clean Markdown, but later states that token exhaustion may cause raw HTML to be returned instead. This behavior change can expose consumers to unexpected content types, larger payloads, and unsafe assumptions in downstream processing that expects normalized Markdown.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.