ClawHub
Back to skill

Security audit

Ai Web Automation Hardened

Security checks for vulnerabilities and agentic risk

Overview

This web automation skill is broad but disclosed, with safety guardrails and no evidence of hidden theft, destruction, or privileged persistence.

Install only if you need web automation for sites and accounts where you have authorization. Keep credentials out of command arguments and prompts, avoid bypassing site protections, confirm destinations before forwarding scraped data, and verify any scheduling behavior yourself because the included code does not implement cron despite the documentation mentioning it.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill advertises web automation, scraping, scheduling, and browser-driven actions that inherently imply network access and likely file output, yet it declares no explicit permissions or constraints. This mismatch weakens policy enforcement and review because consumers and hosting systems cannot reliably determine what capabilities the skill will exercise.

Vague Triggers

Medium
Confidence
77% confidence
Finding
The description 'Automated web task execution service' is broad enough to encompass benign automation as well as scraping, submission, monitoring, and potentially abusive interactions. Without narrow trigger conditions, target restrictions, or usage boundaries, the skill can be invoked in risky contexts and may be repurposed for unintended actions against third-party sites.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SAFETY.md:148