ClawHub
Back to skill

Security audit

Crawl4ai Docker Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real Crawl4AI helper, but its sample deployment can expose a powerful crawler service and LLM-backed data handling more broadly than users may realize.

Install only if you intend to run a local Crawl4AI service and can harden it. Bind the API to 127.0.0.1 unless remote access is explicitly needed, put any remote deployment behind authentication and network filtering, pin the container image to a reviewed version or digest, and avoid sending private, regulated, or proprietary pages to external LLM providers without approval.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/crawl4ai-docker.sh:18
Finding

Unsafe JSON Construction from User-Controlled Shell Arguments

Content
View full analysis
Remediation
View remediation
10000 )); then echo "max_tokens must be an integer between 1 and 10000" >&2 exit 1 fi payload=$(jq -n \ --arg url "$url" \ --arg instruction "$instruction" \ --arg provider "$provider" \ --argjson max_tokens "$max_tokens" \ '{ urls: [$url], extraction_strategy: { type: "llm", provider: $provider, instruction: $instruction, max_tokens: $max_tokens } }') ``` Additional hardening should include: - Allowlist supported extraction strategies and LLM providers. - Permit only explicitly required URL schemes, normally `https`. - Reject embedded credentials and unexpected control characters in URLs. - Enforce URL and instruction length limits. - Use `curl --fail-with-body --show-error` and return nonzero on API failures. - Apply server-side schema validation because client-side validation alone is not a security boundary. ]]>

T08 · Insecure Dependencies

Warning
Location
references/example-config.json:6
Finding

Mutable Latest Tag Used for the Crawl4AI Container Image

Content
View full analysis
Remediation
View remediation
@sha256:" ``` Implement the following supply-chain controls: - Verify the digest through a trusted release channel. - Validate image signatures or provenance where available. - Use automated vulnerability scanning before approving updates. - Update only through a controlled review process rather than automatically following `latest`. - Record the approved image digest in source control. - Run the container as a non-root user when supported. - Set `read_only: true`, drop unnecessary Linux capabilities, and enable `no-new-privileges`. - Keep API credentials narrowly scoped and rotate them if an untrusted image may have received them. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
references/example-config.json:7
Finding

Powerful Crawl4AI API Published on All Host Interfaces Without Documented Access Controls

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (17)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The primary descriptive content is written in Chinese, and the file does not indicate that the skill is region-specific or provide an alternative language option. This can violate language/locale policy when users are not given a choice or opt-in for the imposed language.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill documents repeated shell-based usage via curl, docker compose, and environment-file handling, but it does not declare any explicit tool scope such as allowed-tools or permissions. That omission weakens governance and increases the chance an agent or user invokes shell/network-capable actions beyond what was reviewed, especially in an automation context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill encourages web crawling, screenshots, PDF generation, JavaScript execution, and LLM-based extraction without warning about privacy, sensitive-data capture, robots/ToS restrictions, or legal/compliance risks. In this context, the missing guardrails make misuse more likely because the functionality is explicitly designed to collect and transform third-party web content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

简单 Markdown 提取

bash
curl -X POST "http://localhost:11235/crawl" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": ["https://example.com"],

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This example combines crawling with LLM extraction via an external provider, creating a concrete path for transmitting crawled page content to third-party services. In a scraping skill, that is more dangerous because users may process entire webpages, including proprietary or personal data, without realizing the content can leave the local environment.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

内容总结

bash
curl -X POST "http://localhost:11235/crawl" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": ["https://example.com"],

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

网页截图

bash
curl -X POST "http://localhost:11235/screenshot" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

场景 1：文档网站爬取 | Documentation Site Crawling

bash
curl -X POST "http://localhost:11235/crawl" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": ["https://docs.openclaw.ai/zh-CN"],

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This news extraction example uses LLM-based extraction, which likely forwards crawled article content to an external provider. Because the skill presents it as a routine workflow without disclosure, users may unintentionally transmit copyrighted, licensed, or sensitive content to third parties.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

场景 2：新闻文章提取 | News Article Extraction

bash
curl -X POST "http://localhost:11235/crawl" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": ["https://news-site.com/article"],

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This product scraping example also uses external LLM extraction and may send scraped commercial data, descriptions, or embedded personal data to a third-party model provider. In a scraping context, automated collection at scale increases the likelihood of unintended disclosure and compliance issues.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

场景 3：产品信息抓取 | Product Information Scraping

bash
curl -X POST "http://localhost:11235/crawl" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": ["https://ecommerce-site.com/products"],

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The configuration instructs users to set external LLM provider credentials and use LLM extraction, but it does not warn that crawled page contents may be transmitted to third-party AI services. This creates a real data-exfiltration/privacy risk if users process proprietary, personal, or regulated content under the assumption everything stays local.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The script interpolates untrusted user input directly into a JSON string passed to curl, allowing malformed JSON or JSON injection if the URL contains quotes or control characters. In this context, the data is then transmitted to a local crawling service, which may be induced to process attacker-controlled targets or unexpected parameters, increasing SSRF-style risk depending on the backend service behavior.

Content

Scanner excerpt · scripts/crawl4ai-docker.sh (reported line 20)May include surrounding context.

sh
local strategy="${2:-markdown}"
    
    echo "🌐 抓取网页: $url"
    curl -s -X POST "$CRAWL4AI_URL/crawl" \
        -H "Content-Type: application/json" \
        -d "{\
            \"urls\": [\"$url\"],\n            \"extraction_strategy\": \"$strategy\"\n        }" | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

Both the URL and instruction/provider fields are inserted directly into JSON without escaping, creating a stronger injection surface than the basic crawl path. Because this endpoint drives LLM-based extraction, attacker-controlled input can alter backend request structure, trigger unintended processing, or relay sensitive crawled content to external model providers, making the skill context more dangerous than a generic local API call.

Content

Scanner excerpt · scripts/crawl4ai-docker.sh (reported line 36)May include surrounding context.

sh
echo "🤖 LLM 智能提取: $url"
    echo "指令: $instruction"
    
    curl -s -X POST "$CRAWL4AI_URL/crawl" \
        -H "Content-Type: application/json" \
        -d "{\
            \"urls\": [\"$url\"],\n            \"extraction_strategy\": {\n                \"type\": \"llm\",\n                \"provider\": \"$provider\",\n                \"instruction\": \"$instruction\",\n                \"max_tokens\": $max_tokens\n            }\n        }" | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The screenshot request also embeds the user-supplied URL directly into JSON, so a crafted value can break request structure or inject unexpected fields. Given that screenshot services often fetch and render remote content, this can amplify SSRF or internal network access risks if the backend is allowed to access non-public addresses.

Content

Scanner excerpt · scripts/crawl4ai-docker.sh (reported line 47)May include surrounding context.

sh
local url="$1"
    
    echo "📸 生成网页截图: $url"
    curl -s -X POST "$CRAWL4AI_URL/screenshot" \
        -H "Content-Type: application/json" \
        -d "{\
            \"url\": \"$url\",\n            \"options\": {\n                \"full_page\": true,\n                \"quality\": 80\n            }\n        }" | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/test-crawl4ai.sh (reported line 30)May include surrounding context.

sh
echo "3. 🌐 基础网页抓取测试"
echo "测试 URL: https://httpbin.org/json"

response=$(curl -s -X POST "$CRAWL4AI_URL/crawl" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": ["https://httpbin.org/json"],

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example request sets the LLM instruction to Chinese text ("总结网页的主要内容"), which implies a specific language preference in natural-language behavior. Because the file does not offer an opt-in language choice or explain that this is a region- or locale-specific example, it can violate language/locale policy guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script's comments, status messages, usage text, and examples are all presented in Chinese, and there is no indication that this is a region-specific tool or that users can opt into another language. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script's comments and all user-visible echo messages are in Chinese, which imposes a specific language on users without any opt-in or documented locale justification. This matches the policy category for language or locale constraints in natural-language content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.