ClawHub
Back to skill

Security audit

Anycrawl

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward remote web search, scrape, and crawl integration, with privacy and API-key handling considerations but no evidence of hidden or malicious behavior.

Install only if you are comfortable sending requested URLs, search terms, crawl parameters, extraction prompts, and possibly page content to SkillBoss/HeyBossAI and downstream scraping providers. Prefer a session-scoped or managed secret for SKILLBOSS_API_KEY over adding it to shell startup files, and avoid using the skill on private networks, credentials, personal data, or regulated content unless that use is approved.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 25)May include surrounding context.

AnyCrawl Skill

Web scraping, crawling, and search via SkillBoss API Hub — powered by high-performance multi-threaded crawling backends (Firecrawl, Jina AI, Apify, ScrapingDog, and more).

Setup

Method 1: Environment variable (Recommended)

bash
export SKILLBOSS_API_KEY="your-api-key"

Make it permanent by adding to ~/.bashrc or ~/.zshrc:

bash
echo 'export SKILLBOSS_API_KEY="your-api-key"' >> ~/.bashrc
source ~/.bashrc

Get your API key at: https://heybossai.com

Method 2: OpenClaw gateway config

bash
openclaw config.patch --set SKILLBOSS_API_KEY="your-api-key"

requires.env

text
SKILLBOSS_API_KEY

Functions

1. anycrawl_scrape

Scrape a single URL and convert to LLM-ready structured data via SkillBoss API Hub (type: "scraping").

Parameters:

  • url (string, required): URL to scrape
  • engine (string, optional): Scraping engine - "cheerio" (default), "playwright", "puppeteer"
  • formats (

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

AnyCrawl Skill

Web scraping, crawling, and search via SkillBoss API Hub — powered by high-performance multi-threaded crawling backends (Firecrawl, Jina AI, Apify, ScrapingDog, and more).

Setup

Method 1: Environment variable (Recommended)

bash
export SKILLBOSS_API_KEY="your-api-key"

Make it permanent by adding to ~/.bashrc or ~/.zshrc:

bash
echo 'export SKILLBOSS_API_KEY="your-api-key"' >> ~/.bashrc
source ~/.bashrc

Get your API key at: https://heybossai.com

Method 2: OpenClaw gateway config

bash
openclaw config.patch --set SKILLBOSS_API_KEY="your-api-key"

requires.env

text
SKILLBOSS_API_KEY

Functions

1. anycrawl_scrape

Scrape a single URL and convert to LLM-ready structured data via SkillBoss API Hub (type: "scraping").

Parameters:

  • url (string, required): URL to scrape
  • engine (string, optional): Scraping engine - "cheerio" (default), "playwright", "puppeteer"
  • formats (

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README describes search, scraping, and crawling features backed by an external API service but does not warn users that their queries, URLs, and possibly crawled content will be transmitted off-host to SkillBoss/AnyCrawl. This omission can cause unintentional disclosure of sensitive targets, internal URLs, or proprietary search terms, especially in agent workflows where users may assume processing is local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill clearly routes user-provided URLs, search queries, and crawl targets to SkillBoss API Hub and named third-party backends, but it does not warn users that their input and retrieved content leave the local environment. This creates a privacy and data-governance risk because users may unknowingly submit sensitive internal URLs, proprietary queries, or regulated content to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The setup instructions recommend persisting the API key in shell startup files without warning that such files may be broadly readable, accidentally committed, surfaced in backups, or inherited across sessions and tools. While common, this increases the chance of credential leakage and unauthorized use of the third-party API account.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The skill is explicitly designed to transmit data to an external API endpoint, which is a genuine external data exposure surface in a plugin/agent context. While not inherently malicious, this is security-relevant because all user queries and crawl/scrape targets are processed by a remote third party, potentially exposing confidential inputs or enabling unexpected data sharing.

Content

Scanner excerpt · index.js (reported line 2)May include surrounding context.

js
// AnyCrawl Skill - powered by SkillBoss API Hub
// Scrape, Crawl, and Search web content via https://api.heybossai.com/v1/pilot

const API_KEY = process.env.SKILLBOSS_API_KEY;
const API_BASE = "https://api.heybossai.com/v1";

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The hardcoded external base URL shows that all operations depend on a remote service, making outbound transmission a core behavior of the skill rather than a local-only utility. In an agent setting, that increases risk because users may assume scraping/search execution is local when inputs and derived metadata are actually relayed externally.

Content

Scanner excerpt · index.js (reported line 5)May include surrounding context.

js
// Scrape, Crawl, and Search web content via https://api.heybossai.com/v1/pilot

const API_KEY = process.env.SKILLBOSS_API_KEY;
const API_BASE = "https://api.heybossai.com/v1";

async function pilot(body) {
  if (!API_KEY) {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This skill forwards user-provided search, scrape, and crawl inputs to a third-party service without any built-in disclosure, consent flow, or guardrails about what data may be sent off-platform. That creates a real data-handling risk because users may unknowingly submit sensitive URLs, queries, selectors, schemas, or proxy details to an external API.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.js:4