ClawHub
Back to skill

Security audit

screenshotbase

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Screenshotbase connector, with a minor disclosure issue around treating screenshot capture like a read action.

Before installing, understand that this skill can ask Screenshotbase to capture a webpage and return a hosted screenshot URL using your connected OOMOL account. Use care with private, authenticated, internal, or token-bearing URLs, and prefer explicit confirmation before screenshot capture even though the current safety text treats untagged actions as reads.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill metadata and description frame the capability as 'searching and reading data', but the documented action set includes `take_screenshot`, which actively causes an external side effect by capturing a webpage. This mismatch can mislead an agent or reviewer into treating the skill as read-only, reducing scrutiny and increasing the chance that screenshot capture is triggered without appropriate user confirmation or policy checks.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The safety section says untagged actions are reads, yet `take_screenshot` is left untagged even though it performs an active capture operation. That classification error can cause downstream agents to auto-run the action under read-only assumptions, leading to unintended interaction with external targets, possible capture of sensitive content, and weaker approval controls.

Static analysis

No suspicious patterns detected.