ClawHub
Back to skill

Security audit

pingagi-web

Security checks for vulnerabilities and agentic risk

Overview

This is a minimal web-browsing skill that uses a local browser service to fetch page content, with no hidden install steps or persistence.

Install only if you want agents to use the local browser service for webpage retrieval. Avoid asking it to open private, internal, authenticated, or sensitive URLs unless you explicitly trust the local service and intend for the agent to inspect the returned text, HTML, or screenshot data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger guidance is very broad and can cause the skill to activate for many ordinary browsing-related requests without clear scoping, consent, or safety boundaries. In practice, that increases the chance an agent will invoke this capability on sensitive or unintended targets and fetch external content when a safer or more explicit workflow should have been used.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill does not warn users that requested URLs are sent to a local browser service and that the response may include page text, HTML, and screenshots. This lack of transparency can lead to inadvertent transmission and retrieval of sensitive data, especially if users ask the agent to browse internal, authenticated, or private resources.

External Transmission

Medium
Category
Data Exfiltration
Content
Example command (replace URL with the target webpage):

```
curl -s -X POST http://127.0.0.1:3088/browse \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com"}'
```
Confidence
86% confidence
Finding
The example explicitly posts user-supplied URLs to a local browser service, creating an external transmission boundary from the agent to another service that performs network access and content retrieval. While localhost reduces exposure to the public internet directly, it still enables access to internal resources and can facilitate SSRF-like behavior, private data retrieval, or screenshot/text exfiltration through the browser service.

Static analysis

No suspicious patterns detected.