ClawHub
Back to skill

Security audit

Jina Reader

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward web-page extraction skill, but users should avoid sending private or secret-bearing URLs through it because it uses Jina’s external service.

Install only if you are comfortable with target URLs and retrieved page content being processed by Jina’s external reader service. Use it for public web pages, avoid private links or URLs containing tokens, and treat extracted text as untrusted source material.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/jina-reader.py:30
Finding

Secret-Bearing URLs Are Disclosed to a Third-Party Service

Content
View full analysis

Vulnerability Details

File Location: scripts/jina-reader.py:30-38; scripts/jina-reader.sh:12-15
Vulnerability Type: Sensitive URL disclosure to an external service
Risk Level: Medium

Vulnerable Code

scripts/jina-reader.py:30-38:

python
# Normalize URL
if not url.startswith(('http://', 'https://')):
    url = f'https://{url}'

jina_url = f"https://r.jina.ai/http://{url.replace('http://', '').replace('https://', '')}"

headers = {
    'User-Agent': 'Mozilla/5.0 (compatible; JinaReader/1.0)'
}

try:
    response = requests.get(jina_url, headers=headers, timeout=timeout)

scripts/jina-reader.sh:12-15:

bash
URL="$1"
JINA_API="https://r.jina.ai/http://${URL#http://}"

curl -s "$JINA_API"

Technical Analysis

Both implementations embed the complete user-supplied target URL into a request sent to r.jina.ai. No validation or redaction is applied to URL user information, query parameters, fragments, signed parameters, API tokens, session identifiers, or other credentials.

Consequently, a URL such as a private signed download link or a password-reset link is disclosed in full to the third-party Jina Reader service. The third party may also retrieve and process the content available through that URL. The Skill documentation describes extraction from “any URL” without warning users that complete URLs and remotely accessible content are processed externally.

Attack Path

  1. A user, Agent, or upstream tool supplies a private URL containing a secret, signed query parameter, session identifier, or embedded credential.
  2. The Skill constructs a Jina Reader endpoint containing the complete supplied URL.
  3. The Skill sends that endpoint to https://r.jina.ai.
  4. The third-party service receives the secret-bearing URL and may use it to retrieve the protected resource.
  5. The URL and fetched content may enter third-party request logs, processing systems, or retentio ...[truncated 528 chars]
Remediation
View remediation

Remediation Suggestions

  1. Clearly disclose that target URLs and retrieved content are sent to and processed by r.jina.ai.
  2. Reject URLs containing user-information credentials such as https://user:password@example.com/.
  3. Detect and reject or redact sensitive query parameters, including common token, signature, key, session, and authentication parameter names.
  4. Require explicit user confirmation before transmitting URLs containing query strings or indicators of signed/private access.
  5. Avoid placing secrets in URLs and recommend credential-free public URLs in the documentation.
  6. Offer a direct/local retrieval mode when third-party processing is unnecessary.
  7. Parse and reconstruct URLs with a standard URL library rather than using unrestricted string replacement.
  8. Document third-party data handling, logging, and retention implications so users can make an informed decision.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/jina-reader.py:38
Finding

Untrusted Web Content Is Returned Without an Agent-Safety Boundary

Content
View full analysis

Vulnerability Details

File Location: scripts/jina-reader.py:38-40,71-75; scripts/jina-reader.sh:15; SKILL.md:71-87
Vulnerability Type: Indirect prompt-injection exposure through untrusted remote content
Risk Level: Medium

Vulnerable Code

scripts/jina-reader.py:38-40:

python
response = requests.get(jina_url, headers=headers, timeout=timeout)
response.raise_for_status()
content = response.text

scripts/jina-reader.py:71-75:

python
else:
    return {
        'status': 'success',
        'content': content
    }

scripts/jina-reader.sh:15:

bash
curl -s "$JINA_API"

The documented workflow in SKILL.md directs consumers to process the retrieved text:

markdown
When using tavily-search, web_search, or searxng skills:
1. Get search results with relevant URLs
2. Extract content from top results using jina-reader
3. Process and summarize the extracted content

Technical Analysis

The Skill returns remotely controlled webpage content directly to standard output or a downstream Agent workflow. It does not label the response as untrusted data, establish an instruction/data boundary, or warn consuming Agents not to obey commands embedded in retrieved pages.

An attacker who controls a retrieved page can place prompt-like instructions in its visible content. Jina Reader can convert those instructions into Markdown, after which this Skill forwards them unchanged. If a consuming Agent treats the text as authoritative instructions rather than untrusted source material, this creates an indirect prompt-injection path.

The Skill does not itself execute the returned text as code. Exploitation therefore depends on a downstream Agent interpreting hostile page content as instructions and possessing tools or sensitive context that could be misused.

Attack Path

  1. An attacker creates or modifies a webpage containing instructions aimed at an AI ...[truncated 1091 chars]
Remediation
View remediation

Remediation Suggestions

  1. Mark all retrieved webpage content explicitly as untrusted external data.
  2. Wrap returned content in a clear structured boundary that distinguishes source data from Agent instructions.
  3. Update SKILL.md to state that downstream Agents must never follow instructions, requests, links, or tool-use directives found in retrieved content.
  4. In JSON output, include trust and provenance fields such as "trusted": false, the requested URL, and the retrieval service.
  5. Ensure downstream workflows summarize or extract facts from the content without granting it control over goals, policies, or tool invocation.
  6. Require separate user confirmation for consequential actions suggested by retrieved content.
  7. Apply least privilege to any Agent consuming the output and restrict filesystem, credential, network, and execution tools unless necessary.
  8. Where supported by the host framework, place external content in a dedicated untrusted-data channel rather than an instruction channel.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill invokes shell commands, performs network access, and supports file output, but the manifest does not declare any explicit tool scope or permissions. This weakens policy enforcement and user visibility, making it easier for the skill to be granted broader capabilities than necessary or used in unintended ways such as writing files or fetching attacker-controlled URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description and usage instructions encourage users to submit arbitrary URLs for extraction via the Jina Reader API, but do not warn that both the requested URL and fetched page content are transmitted to a third-party external service. This creates a privacy and data-handling risk, especially if users provide internal, sensitive, or confidential links under the assumption processing is local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This skill sends a user-supplied URL to the third-party service r.jina.ai for processing, which discloses the requested destination and potentially sensitive query parameters or internal hostnames to an external provider. Because the tool description presents this behavior as general-purpose URL extraction and the code provides no explicit warning, consent prompt, or restriction on sensitive/internal URLs, users may unintentionally exfiltrate confidential targets or access patterns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script sends a user-supplied URL to a third-party service (r.jina.ai) without any explicit warning, consent, or disclosure. This can expose sensitive URLs, query strings, tokens, or internal hostnames to an external provider, which is especially risky in a research or browsing workflow where users may pass private links assuming only local fetching occurs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The inline description uses Chinese only ("网页内容提取工具"), which imposes a specific language in user-facing text without any opt-in or explanation. This can violate language or locale policy when no user choice or documented regional scope is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.