ClawHub
Back to skill

Security audit

Scientific Proxy

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it fetches, tests, and formats free public proxy nodes, but users should treat those proxies as untrusted.

Install only if you intentionally want local Python code to download mutable public proxy lists, test remote endpoints, and cache proxy configs locally. Do not use the resulting free proxies for banking, email, work accounts, financial activity, or other sensitive browsing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tainted flow: 'output_path' from os.environ.get (line 133, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
print(f"Total: {len(all_nodes)}, Unique: {len(unique)}, Protocols: {protocols}")
    result = {"scraped_at": datetime.now().isoformat(), "total": len(unique), "protocols": protocols, "nodes": unique}
    os.makedirs(os.path.dirname(output_path), exist_ok=True)
    with open(output_path, 'w', encoding='utf-8') as f:
        json.dump(result, f, ensure_ascii=False, indent=2)
    print(f"Saved {len(unique)} nodes to {output_path}")
Confidence
92% confidence
Finding
The script builds the output file path from the OPENCLAW_WORKSPACE environment variable and then writes to it without validating or constraining the destination. If an attacker can influence the environment, they can redirect writes to arbitrary filesystem locations, causing unintended file overwrite or data placement outside the expected workspace.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The README explicitly promotes automatically scraping free proxy nodes from public sources and guiding inexperienced users to import them, but provides no warning that such nodes are untrusted and can intercept, log, or tamper with traffic. In this context, the omission is security-relevant because the skill lowers the barrier for users to route sensitive traffic through unknown third parties, increasing risk of surveillance, credential theft, and malicious configuration delivery.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger condition is defined as any message related to proxy nodes, which is overly broad and can cause the skill to activate in unintended contexts. In a security-sensitive skill that immediately executes a local script, broad activation increases the chance of unsolicited script execution and misuse without clear user intent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill mandates execution of a local Python script and returning its raw output with no explanation, consent flow, or description of what the script accesses or does. Because the skill content must be treated as adversarial and the script is external to the reviewed file, this creates a significant trust boundary issue and could enable hidden code execution, data access, or delivery of unsafe proxy configurations.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The scraper collects and persists proxy subscription data that includes credential-like secrets such as UUIDs, passwords, and access tokens from vmess, vless, trojan, and ss nodes. Writing these values in plaintext JSON to disk creates a sensitive data exposure risk if the workspace is shared, backed up, logged, or readable by other users or processes.

Static analysis

No suspicious patterns detected.