ClawHub
Back to skill

Security audit

Opengraph Io

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but its setup and examples create review-worthy risks around unpinned local code execution, external data processing, and proxy-based scraping guidance.

Install only if you are comfortable sending target URLs, page content, screenshots, prompts, and generated asset data to OpenGraph.io. Avoid using it on private, authenticated, regulated, or internal pages unless approved. Prefer a pinned, reviewed MCP package version or the REST examples, protect the App ID like a credential, and use proxy features only for authorized access that complies with site terms and law.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
references/mcp-clients.md:5
Finding

Unpinned npm Package Is Downloaded and Executed Through npx

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:104
Finding

API Credential Can Be Exposed Through Command-Line Arguments and URL Query Strings

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README promotes scraping, screenshotting, extraction, and AI querying of webpages but does not clearly disclose that submitted URLs and page contents are sent to a third-party service. This can lead users to unknowingly transmit sensitive internal URLs, authenticated page content, or proprietary data outside their environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

md
- 🌐 **Scrape content** — Fetch HTML with JavaScript rendering
- 🔍 **Extract elements** — Pull specific HTML elements (h1, p, etc.)
- 🤖 **Query pages** — Ask AI questions about any webpage
- 🎨 **Generate images** — Create diagrams, icons, social cards, QR codes

## Quick Start

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The README instructs users to run npx opengraph-io-mcp without pinning a specific version, which means the latest published package will be fetched and executed at install time. If the package is compromised, typosquatted, or a malicious update is published, users could execute attacker-controlled code on their machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README explicitly encourages proxy-enabled scraping of geo-restricted or bot-protected sites without warning about legal, privacy, abuse, or target-system policy implications. In a skill whose purpose is automated web interaction, this increases the chance of misuse against protected services and may expose users or operators to compliance and reputational risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger phrases are broad natural-language patterns such as 'scrape this URL' and 'what does this page say about', which can overlap with ordinary browsing or summarization requests. In an automated agent environment, this increases the chance of unintended activation and sending user data or target URLs to the third-party service without sufficiently explicit consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill prominently encourages scraping webpages, querying page content, and generating outputs through a third-party API, but it does not explicitly warn that user-supplied URLs, page contents, prompts, and possibly sensitive internal resources may be transmitted to OpenGraph.io. In an agent setting, this omission can lead to inadvertent exfiltration of confidential data or access patterns to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

This step creates a remote session by POSTing data to https://opengraph.io/image-agent/sessions, which is an external transmission to a third-party service. While expected for the product's function, it is still security-relevant because agent users may not realize prompts, session metadata, and related workflow context are leaving the local environment.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

Step 1: Create a Session

bash
SESSION=$(curl -s -X POST "https://opengraph.io/image-agent/sessions?app_id=${OPENGRAPH_APP_ID}" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-session"}')
SESSION_ID=$(echo $SESSION | jq -r '.sessionId')

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

The image generation call transmits prompt content and parameters to OpenGraph.io, which may include sensitive business information, internal URLs, or user data if an agent constructs prompts from prior conversation context. The danger is amplified in autonomous workflows because data can be forwarded externally without the user fully appreciating the transmission boundary.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

Step 2: Generate an Image

bash
curl -s -X POST "https://opengraph.io/image-agent/sessions/${SESSION_ID}/generate?app_id=${OPENGRAPH_APP_ID}" \
  -H "Content-Type: application/json" \
  -d '{
    "prompt": "A beautiful QR code linking to https://example.com with modern gradient design",

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This premium QR marketing card example sends a rich prompt, including a destination URL and creative instructions, to the external image-generation API. If adapted to real use, such prompts can expose non-public campaigns, product names, or internal links to the provider, especially when agents auto-compose them from user context.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

bash
# Premium QR marketing card example
curl -s -X POST "https://opengraph.io/image-agent/sessions/${SESSION_ID}/generate?app_id=${OPENGRAPH_APP_ID}" \
  -H "Content-Type: application/json" \
  -d '{
    "prompt": "Premium marketing card with QR code for https://myapp.com, cosmic purple gradient background with floating 3D spheres, glowing accents, SCAN TO DOWNLOAD call-to-action",

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill instructs users to run an MCP server via npx opengraph-io-mcp without pinning a specific version or integrity-verified artifact. This creates a supply-chain risk: future package updates, dependency compromise, or typosquat-style replacement could cause arbitrary code execution in the user's environment when the installer or server is launched.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This example explicitly promotes scraping through a residential proxy to avoid geo-blocking, rate limiting, and bot detection, which normalizes evasive behavior without any guardrails or warning about authorization, site terms, or legal constraints. In a skill specifically designed for web scraping and screenshot capture, such guidance materially increases the likelihood of misuse for unauthorized collection or access against third-party sites.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The scrape endpoint documentation encourages sending arbitrary target URLs and returning full rendered HTML through OpenGraph.io, but it does not warn that both the requested URL and potentially sensitive page contents are transmitted to and processed by a third-party service. In a skill explicitly designed for scraping webpages, this omission can lead users or downstream agents to exfiltrate internal, authenticated, or otherwise sensitive web content without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The screenshot endpoint allows capture of arbitrary webpages and returns hosted screenshot URLs, but the docs omit any warning that visible page content may be transmitted to and stored by an external provider. In this skill context, screenshots of dashboards, inboxes, admin panels, or logged-in sessions could expose secrets or personal data to a third party if users assume the action is local or low-risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The AI query endpoint analyzes webpage contents using an AI-backed service, yet the documentation provides no privacy warning that page contents and user prompts may be processed by a third party. Because this feature invites semantic analysis of arbitrary webpages, it increases the chance that confidential or regulated content is submitted for external AI processing without the user's informed understanding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file describes capabilities that fetch rendered HTML, capture screenshots, extract page elements, and ask AI questions about page content. Those behaviors can affect privacy or transmit page data to external services, but the document provides no user warning or disclosure about sensitive content, consent, or appropriate data handling.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The documentation instructs users to execute an npm package via npx without pinning an exact version. This allows whatever version is current on the registry at install time to be fetched and executed, creating a supply-chain risk if a malicious or compromised release is published.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The guide directs users to place OPENGRAPH_APP_ID in client configuration files but does not warn that such files may be readable by other local users, captured in backups, synced to cloud services, or accidentally committed to source control. While an app ID may be lower sensitivity than a private API secret, it is still an account credential and should be treated carefully.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This command uses npx -y opengraph-io-mcp without an exact version, which causes the client to automatically download and run the latest package release. In an MCP setup guide, this is especially risky because users are being told to trust and execute code that may later change without review.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The troubleshooting guidance again tells users to run npx opengraph-io-mcp without pinning a version. Even in troubleshooting, this encourages execution of mutable third-party code and can expose users to dependency hijacking or malicious package updates.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The manual run example OPENGRAPH_APP_ID=xxx npx opengraph-io-mcp executes an unpinned package while also handling a credential. A compromised package version could steal the supplied app ID or perform other malicious actions under the user's account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file instructs users to use use_proxy=true and auto_proxy=true for geo-restricted, rate-limited, and paywalled sites, but it does not include any warning about privacy implications, terms-of-service concerns, or the fact that requests may be routed through proxy infrastructure. Under the markdown-specific warning rule, behavior that can affect user privacy or system/network integrity should be disclosed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The documented default accept_lang value forces en-US,en;q=0.9, which is a locale preference baked into the skill documentation rather than chosen by the user. SQP-3 applies because this natural-language locale default is presented without opt-in or a documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This parameter table specifies accept_lang with an English default header value, which can bias fetched content toward English-language variants absent any user preference. That is a natural-language locale policy concern under SQP-3.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.