ClawHub
Back to skill

Security audit

DOM Capture Engine

Security checks for vulnerabilities and agentic risk

Overview

This is a documented DOM screenshot/export helper, with a privacy caution around optional third-party CORS proxy and CDN examples.

Use this skill only on page elements you intend to capture. Avoid the example third-party CORS proxy for internal dashboards, authenticated pages, tokenized URLs, or private content; use same-origin assets or a trusted self-hosted proxy instead. Prefer pinned npm/CDN versions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly recommends sending cross-origin image fetches through a third-party CORS proxy (`https://proxy.corsfix.com/?`) to make DOM capture work, but it does not warn that proxied resources and related request metadata are disclosed to that external service. In the context of capturing DOM content, this can expose sensitive page assets, internal URLs, tokens in query strings, or user-specific content to an untrusted intermediary, making the omission a real privacy and security issue.

Static analysis

No suspicious patterns detected.