Security audit

Swipenode

Security checks for vulnerabilities and agentic risk

Overview

SwipeNode is a web-scraping skill that openly uses WAF-bypass/TLS spoofing and installs an unaudited external binary/MCP server, so it needs Review before installation.

Install only after reviewing the actual SwipeNode source you intend to build, pinning a trusted commit or release, and confirming which repository is canonical. Use it only on sites where you have permission to automate access, avoid passing secrets in headers unless required, and review any Claude Desktop MCP configuration changes before enabling them.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:134
Finding: Unpinned Remote Source Retrieval and Execution
Content: View full analysis
~/.openclaw/workspace/skills/swipenode/swipenode install-mcp ``` ### Technical Analysis The installation process clones the mutable default branch of an external GitHub repository and immediately compiles it into a locally executable binary. It does not pin a reviewed commit, verify a cryptographic checksum, validate a release signature, or include the source code in the audited package. Consequently, the code ultimately executed can differ from the code present when the Skill documentation was reviewed. A repository compromise, malicious update, ownership transfer, or force-push could replace the effective payload without requiring any change to this Skill package. The source identity is also inconsistent: `SKILL.md` references `sirToby99/swipenode`, while `README.md` directs users to clone `Nefas11/swipenode`. This ambiguity increases the chance of retrieving an unintended or less trusted implementation. No executable source, dependency manifest, binary, checksum, or signature is included in the audited artifact. Therefore, the implementation's network behavior, handling o ...[truncated 1889 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README prominently markets 'bypasses Cloudflare/Datadome via TLS fingerprint spoofing' without any warning about legal, policy, or abuse implications. In a skill intended for AI agents, this normalizes access-control evasion and makes misuse more likely, especially because agents may be directed to scrape sites that deliberately restrict automated access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The README instructs users to run network-fetching and desktop configuration registration commands for agent integration without clearly warning that the tool will make outbound requests and modify local Claude Desktop MCP configuration. In an agent-skill context, that omission increases the chance of unreviewed network access and local system changes being enabled by users or agents who treat the skill as low risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad and generic, including terms like "scrape," "cloudflare," and "extract data," which can cause the skill to be invoked in contexts where the user did not specifically request this tool. In this skill’s context, that is more dangerous because it advertises WAF/TLS spoofing and scraping functionality, so accidental invocation could steer an agent toward unauthorized data extraction or protective-control bypass behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.