Security audit

Webclaw Hybrid Engine Ln

Security checks for vulnerabilities and agentic risk

Overview

This web-scraping skill has a coherent purpose, but it overreaches by trying to control all web access and by directing users to run an unpinned npm package.

Review this before installing. Use it only if you trust the separate WebClaw engine package and are comfortable routing requested URLs through a local service. Prefer a pinned, verified install source and avoid sending private, credential-bearing, signed, or internal URLs unless the gateway's handling and logging behavior are known.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:3
Finding: Mandatory Tool Selection and Agent Output Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:33
Finding: Unpinned and Unaudited npm Package Execution Recommendation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:13
Finding: Mandatory Disclosure of Complete Target URLs to an Opaque Local Service
Content: View full analysis
", "mode": "auto"}` *(Note: Use your native HTTP request capabilities; do not spawn external shell binaries like curl unless your environment explicitly requires it.)* 2. Extract the `data.markdown` from the JSON response. ``` ### Technical Analysis The integration requires the complete target URL to be sent to a process listening on local TCP port 8822. URLs can contain sensitive information, including signed query parameters, bearer tokens, private hostnames, document identifiers, session data, and internal network locations. Use of `localhost` means the Markdown file does not directly transmit the URL to an external host. However, the receiving gateway implementation is absent from the audited project. Its logging, retention, forwarding, DNS behavior, redirect handling, and outbound network activity cannot be verified. The service necessarily receives the URL and is expected to fetch the referenced destination. Mandating this intermediary for every URL is broader than necessary. The instructions contain no validation rules, credential redaction, protoc ...[truncated 1161 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs the user to run npx webclaw-hybrid-engine-ln, which fetches and executes the latest package version from the registry without pinning or integrity verification. If the package is updated maliciously, compromised through account takeover, or replaced via dependency confusion/supply-chain compromise, the user may execute attacker-controlled code on their machine.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.