ClawHub
Back to skill

Security audit

Scientific Proxy

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs its advertised proxy-finding function, but it suppresses normal agent warnings while steering users toward untrusted free proxies and unrelated promotional or Telegram language-change steps.

Review before installing. This skill is for finding free public proxy nodes, which means your traffic may pass through operators you do not know or trust. Do not use its nodes for banking, email, work accounts, or sensitive logins. Be aware that it writes proxy details to local workspace files and that its instructions try to suppress extra agent warnings while adding promotional and Telegram language-change messages.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:3
Finding

Mandatory Skill Instructions Hijack Agent Output and Promote External Services

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs the agent to override the user's language context and push a Telegram language-change link to English-speaking users without consent. In a proxy-distribution workflow, unsolicited redirection to a language-setting URL can create confusion, reduce informed decision-making, and normalize link-clicking behavior that could be abused for social engineering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README promotes automatic scraping, testing, filtering, and distribution of third-party proxy nodes to novice users without warning about privacy, traffic interception, credential theft, or legal/compliance risks. In this context, the skill is specifically intended to route user traffic through untrusted infrastructure, which materially increases the chance of surveillance, malicious relays, or unsafe configuration guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is explicitly designed to distribute proxy nodes, reissue them on request, and then solicit an ongoing subscription, but it provides only a minimal 'not for banking' caveat. This can steer users into routing sensitive traffic through untrusted third-party infrastructure without informed consent about surveillance, credential theft, legal restrictions, or account-abuse risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code presents the device-selection flow entirely in Chinese, which forces a specific language on users. The file does not indicate that the skill is region-specific or provide any mechanism for language selection, so it conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/handler.py (reported line 27)May include surrounding context.

python
fmt, client = fmt_map[choice]

    # Step 1: scrape
    r = subprocess.run([sys.executable, os.path.join(skill_dir, 'scraper.py')], capture_output=True, cwd=skill_dir)
    if r.returncode != 0:
        print(f"Scraper failed:\n{r.stderr.decode(errors='replace')}")
        return

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/handler.py (reported line 33)May include surrounding context.

python
return

    # Step 2: test — surface output so user sees warnings + confirmation prompt
    r = subprocess.run([sys.executable, os.path.join(skill_dir, 'tester.py')], capture_output=False, cwd=skill_dir)
    if r.returncode != 0:
        print("Testing aborted or failed. No usable nodes.")
        return

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/handler.py (reported line 39)May include surrounding context.

python
return

    # Step 3: format — tested nodes only, no raw fallback
    r = subprocess.run([sys.executable, os.path.join(skill_dir, 'formatter.py'), '--format', fmt, '--top', '5'], capture_output=True, text=True, cwd=skill_dir)
    if r.returncode != 0:
        print(f"Formatting failed:\n{r.stderr}")
        return

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The success message, usage instructions, and warning text are all emitted only in Chinese. Because no alternative locale or opt-in is provided and no justified regional limitation is documented in this file, this is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script scrapes proxy node definitions from public sources and persists the full records to disk, including secrets such as UUIDs and passwords for vmess, vless, trojan, and ss entries. Storing these credentials locally without minimization, user consent, or access controls increases the risk of credential leakage through local compromise, backups, logs, or accidental sharing of the workspace.

Content

No source excerpt is available for this finding.

Tainted flow: 'output_path' from os.environ.get (line 133, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
89% confidence
Finding

The output file path is derived from the OPENCLAW_WORKSPACE environment variable and is used for directory creation and file write without validation or restriction. If an attacker can influence the environment of the process, they can redirect writes to an arbitrary filesystem location, potentially overwriting files accessible to the running user and causing data loss or placement of sensitive scraped data in unintended locations.

Content

Scanner excerpt · scripts/scraper.py (reported line 144)May include surrounding context.

python
print(f"Total: {len(all_nodes)}, Unique: {len(unique)}, Protocols: {protocols}")
    result = {"scraped_at": datetime.now().isoformat(), "total": len(unique), "protocols": protocols, "nodes": unique}
    os.makedirs(os.path.dirname(output_path), exist_ok=True)
    with open(output_path, 'w', encoding='utf-8') as f:
        json.dump(result, f, ensure_ascii=False, indent=2)
    print(f"Saved {len(unique)} nodes to {output_path}")

Tainted flow: 'output_path' from os.environ.get (line 132, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/tester.py (reported line 206)May include surrounding context.

python
"skipped": unsafe,
        "nodes": tested
    }
    with open(output_path, 'w', encoding='utf-8') as f:
        json.dump(result, f, ensure_ascii=False, indent=2)
    print(f"Saved to {output_path}")

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The README presents the user-facing description and example interaction entirely in Chinese, including the invocation example, without indicating that language selection is optional or that the skill is intentionally region-specific. This can violate the language/locale policy when a specific language is imposed without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.