ClawHub
Back to skill

Security audit

GetMarkdown

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward WebCrawlerAPI wrapper for scraping or crawling web pages, with expected third-party API use and disclosed local crawl output.

Install only if you are comfortable sending requested URLs to WebCrawlerAPI and storing crawl results in your working directory. Use it for public pages, avoid internal or authenticated URLs, and review crawl scope before asking for full-site crawls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

External Script Fetching

High
Category
Supply Chain
Content
## Setup — API Key

The API key must be set as an environment variable before running any curl commands:

```bash
export WEBCRAWLERAPI_API_KEY="your_api_key"
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README states that crawling saves pages as markdown files locally, but it does not prominently warn users about filesystem side effects, destination paths, storage growth, or the fact that a crawl may create many files. In this context, silent local writes are more dangerous because the skill performs asynchronous website-wide crawling, which can produce substantial on-disk changes beyond what a user may expect from a simple content-fetching skill.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrase is overly broad and can cause the skill to activate for common requests like general web search or web fetch, increasing the chance of unexpected network access and tool use when the user did not specifically request this capability. In a skill that can scrape pages and crawl domains, broad triggering expands the attack surface and may lead to unreviewed external requests or downstream filesystem side effects.

External Transmission

Medium
Category
Data Exfiltration
Content
## Setup — API Key

The API key must be set as an environment variable before running any curl commands:

```bash
export WEBCRAWLERAPI_API_KEY="your_api_key"
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --fail --silent --show-error \
  --request POST \
  --url "https://api.webcrawlerapi.com/v2/scrape" \
  --header "Authorization: Bearer ${WEBCRAWLERAPI_API_KEY}" \
  --header "Content-Type: application/json" \
  --data '{
Confidence
85% confidence
Finding
The scrape command sends a user-supplied URL and authentication token to an external service, which means requested resources and potentially sensitive targets are disclosed to a third party. In an agent setting, this can create privacy and data-handling risk, especially if users ask to fetch internal, authenticated, or otherwise sensitive pages.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl --fail --silent --show-error \
  --request POST \
  --url "https://api.webcrawlerapi.com/v1/crawl" \
  --header "Authorization: Bearer ${WEBCRAWLERAPI_API_KEY}" \
  --header "Content-Type: application/json" \
  --data '{
Confidence
89% confidence
Finding
The crawl operation submits a whole-site URL to an external service, potentially causing large-scale transmission of browsing targets and retrieval of many pages by a third party. This broadens the exposure compared with single-page scrape mode and increases the chance of collecting sensitive or unexpected content from the target domain.

External Transmission

Medium
Category
Data Exfiltration
Content
while true; do
  RESULT=$(curl --fail --silent --show-error \
    --request GET \
    --url "https://api.webcrawlerapi.com/v1/job/${JOB_ID}" \
    --header "Authorization: Bearer ${WEBCRAWLERAPI_API_KEY}")
  STATUS=$(echo "$RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin)['status'])")
  echo "Job status: $STATUS"
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The crawl workflow instructs the agent to automatically write multiple fetched pages to disk under `.webcrawlerapi/` without an upfront warning or explicit user confirmation. In an agent context, silent filesystem writes are security-relevant because they create persistent artifacts from untrusted remote content and may surprise users who expected only a transient fetch.

Static analysis

No suspicious patterns detected.