ClawHub
Back to skill

Security audit

extractor

Security checks across malware telemetry and agentic risk

Overview

The extractor appears to be a legitimate HTML data extraction tool, but it has an under-documented LLM path that can send raw page HTML and an API key to a configurable network endpoint.

Install only if you are comfortable with user-directed URL fetching and, for LLM extraction, sending page HTML to a trusted local or remote model endpoint. Use CSS, XPath, or regex for sensitive pages; verify OPENAI_BASE_URL and OPENAI_API_KEY before calling extract_by_llm; avoid untrusted/internal URLs unless that access is intentional.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Tainted flow: 'req' from os.environ.get (line 291, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
try:
            req = urllib.request.Request(url, data=payload, headers=headers, method="POST")
            with urllib.request.urlopen(req, timeout=60) as resp:
                result = json.loads(resp.read().decode("utf-8"))

            # 解析响应
Confidence
94% confidence
Finding
with urllib.request.urlopen(req, timeout=60) as resp:

Missing User Warnings

Medium
Confidence
78% confidence
Finding
The skill explicitly supports loading remote URLs and processing their contents, but the documentation does not warn users that this causes outbound network access and may send requests to untrusted or sensitive endpoints. In agent contexts, this can enable unintended access to internal resources, leak browsing intent, or process attacker-controlled content without informed user consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The LLM extraction path transmits raw HTML content to an external or configurable model API without an explicit user warning or consent gate. HTML can contain sensitive business data, personal information, hidden fields, tokens, or internal content, so this creates a real confidentiality risk even if the code's feature is intentional.

Ssd 3

Medium
Confidence
96% confidence
Finding
The prompt construction embeds raw HTML directly into the model request body, which can leak sensitive page content to a remote service and to any intermediaries or logs associated with that service. Because the whole page is transmitted in plain prompt text, exposure is broader than targeted field extraction and may include secrets or regulated data present in the DOM.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.