ClawHub

Crawl By Desearch

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Desearch web-crawling helper, but users should understand that requested URLs are processed by an external service.

Use this only for URLs you are comfortable sending to Desearch, and use a dedicated Desearch API key that you can rotate or revoke. Avoid intranet, localhost, authenticated, confidential, or token-bearing URLs unless external processing by Desearch is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill requires an API key via environment variables and performs outbound web crawling through a third-party service, but it does not declare permissions for env or network access. This weakens security transparency and policy enforcement, making it easier for an agent or operator to invoke external access and secret-dependent behavior without explicit review.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill advertises that it can crawl any webpage URL but does not warn users that both the target URL and fetched content are transmitted to an external third-party provider. This can cause accidental disclosure of sensitive internal URLs, tokens embedded in query strings, or confidential page contents when users assume the fetch is local.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal