ClawHub
Back to skill

Security audit

scavio-extract

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Scavio URL-reading integration, but users should remember that URLs are sent to Scavio for server-side fetching.

Install this only if you are comfortable using Scavio as a third-party page extraction service. Do not use it on secret-bearing signed URLs, private documents, internal-only links, or regulated data unless the user explicitly approves that those URLs and fetched contents may be processed by Scavio.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger guidance is broad enough that an agent may invoke this skill whenever a user pastes or mentions a link, even when the user did not explicitly consent to sending that URL and its retrieved contents to a third-party service. In this skill’s context, that can cause unnecessary external data transmission and surprise fetches of sensitive or internal-looking links, increasing privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill description does not clearly warn that user-supplied URLs and fetched page contents are transmitted to an external service operated by Scavio. That omission undermines informed consent and can lead users or upstream agents to send confidential links or page contents to a third party without realizing it.

External Transmission

Medium
Category
Data Exfiltration
Content
HEADERS = {"Authorization": f"Bearer {os.environ['SCAVIO_API_KEY']}"}

# 1. The common case: a page as clean Markdown, 1 credit
page = requests.post(f"{BASE}/api/v1/extract", headers=HEADERS,
    json={"url": "https://example.com/pricing"}).json()

print(page["data"]["content"][:500], page["data"]["content_length"])
Confidence
90% confidence
Finding
requests.post(f"{BASE}/api/v1/extract", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
print(page["data"]["content"][:500], page["data"]["content_length"])

# 2. Plain text for an embedding pipeline, still 1 credit
plain = requests.post(f"{BASE}/api/v1/extract", headers=HEADERS,
    json={"url": "https://example.com/blog/post", "format": "text"}).json()

# 3. A client-rendered page: advanced renders JavaScript and STILL costs 1 credit
Confidence
90% confidence
Finding
requests.post(f"{BASE}/api/v1/extract", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
json={"url": "https://example.com/blog/post", "format": "text"}).json()

# 3. A client-rendered page: advanced renders JavaScript and STILL costs 1 credit
spa = requests.post(f"{BASE}/api/v1/extract", headers=HEADERS,
    json={"url": "https://example.com/app/docs", "mode": "advanced"}).json()

# 4. Raw HTML to parse yourself
Confidence
90% confidence
Finding
requests.post(f"{BASE}/api/v1/extract", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
def read(url, format="markdown"):
    """normal (1cr) -> advanced (1cr) -> ultra (2cr). Only the successful call is billed."""
    for mode in ("normal", "advanced", "ultra"):
        r = requests.post(f"{BASE}/api/v1/extract", headers=HEADERS,
                          json={"url": url, "format": format, "mode": mode})
        if r.status_code == 200:
            data = r.json()["data"]
Confidence
92% confidence
Finding
requests.post(f"{BASE}/api/v1/extract", headers=HEADERS, json=

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:40