ClawHub
Back to skill

Security audit

Tinyfish

Security checks for vulnerabilities and agentic risk

Overview

This skill is a legitimate web-search and browser-automation helper, but it gives a third-party CLI broad remote browsing and form-interaction authority without enough safeguards.

Review before installing. Use this only if you are comfortable with TinyFish processing web requests and automation goals remotely. Avoid entering passwords, API keys, payment data, private URLs, or sensitive account content through the remote browser unless you have separately accepted that risk. Prefer a pinned or isolated CLI install instead of the documented global install.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:10
Finding

Unpinned Global Installation of a Third-Party CLI

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 10
Vulnerability Type: Supply-chain risk through an unpinned globally installed dependency
Risk Level: High

Vulnerable Code Snippet:

markdown
If not installed: `npm install -g @tiny-fish/cli`

Technical Analysis

The Skill instructs the Agent to install the latest available release of @tiny-fish/cli globally. The command does not specify an exact reviewed version, integrity hash, lockfile, or package provenance requirement.

A global npm installation can execute package installation logic with the permissions of the user running npm. Because the requested version is not pinned, the code installed during a future invocation may differ from the version originally reviewed. Compromise of the package, its publishing account, or one of its transitive dependencies could consequently introduce arbitrary executable behavior without any change to this Skill file.

The global installation scope also exceeds the minimum scope required for an individual Skill invocation. It changes the user's persistent tool environment and makes the installed CLI available to unrelated projects and future sessions.

Attack Path

  1. An attacker compromises the npm package, a maintainer account, or a transitive dependency used by a future @tiny-fish/cli release.
  2. A user invokes the Skill on a system where the CLI is not installed.
  3. The Agent follows the documented command and installs the current package globally.
  4. npm executes package or dependency lifecycle code with the installing user's privileges.
  5. The compromised package can access files and credentials available to that user or install a modified CLI that executes attacker-controlled behavior during later calls.
  6. Because the installation is global and persistent, the compromised tool may affect later sessions and unrelated workflows.

Impact Assessment

Successful exploitation could provid ...[truncated 553 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin @tiny-fish/cli to an exact, reviewed version rather than installing the latest release.
  • Verify the package's registry provenance, publisher identity, and integrity metadata before installation.
  • Prefer a project-local, isolated installation rather than the persistent global -g scope.
  • Use a lockfile or equivalent reproducible dependency manifest for the CLI and its transitive dependencies.
  • Disable npm lifecycle scripts during installation unless they are verified as necessary.
  • Run the CLI in a sandbox or container with restricted filesystem, environment-variable, and network access.
  • Document a controlled upgrade and security-review process before changing the pinned version.
  • Never install the package with administrative privileges unless a separately reviewed requirement makes that unavoidable.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:17
Finding

Automatic Remote Processing of Potentially Sensitive Browser Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–24; supporting behavior at lines 134–145 and 193–207
Vulnerability Type: Excessive remote browsing privileges and insufficient controls for sensitive data
Risk Level: Medium

Vulnerable Code Snippet:

markdown
Use TinyFish whenever a request depends on live web information or page content. Do not wait for the user to say "TinyFish" or "scrape".

Strong triggers include:

- Search or discovery: search, find, look up, research, compare, latest, current, news, docs, pricing, product details, best options.
- URL/page reading: fetch, read, summarize, extract from this page, inspect this URL, get the content, pull links or metadata.
- Source-backed answers: answer using web sources, verify a fact, check whether something changed, gather information from the web.
- Website work: interact with a site, click through pages, fill forms, log in, collect structured data, handle bot-protected pages.

The associated remote automation interface is documented as:

markdown
tinyfish agent run --url <url> "<goal>" [--sync] [--async] [--pretty]

The Skill also supports remote browser sessions:

markdown
### `tinyfish browser session create`

Spin up a remote browser instance. Returns a CDP WebSocket URL for programmatic control.

```bash
tinyfish browser session create [--url <url>] [--pretty]
  • --url optionally navigates to a page after creation
  • Returns session_id, cdp_url (WebSocket), and base_url
  • Use the cdp_url with Playwright, Puppeteer, or any CDP client
text

### Technical Analysis

The Skill instructs the Agent to use TinyFish automatically for broad categories of web activity, including logging in, filling forms, and operating a remote browser. This may send URLs, natural-language goals, page contents, extracted results, and form data outside the local trust boundary.

The instructions 
...[truncated 2234 chars]
Remediation
View remediation

Remediation Suggestions

  • Require explicit, informed user confirmation before using remote automation for login flows, authenticated pages, or form submissions.
  • Clearly disclose that URLs, goals, page contents, and entered data may be processed by a third-party remote service.
  • Prohibit entering passwords, API keys, recovery codes, payment-card data, private keys, and other high-value secrets through remote automation.
  • Use local browser automation for sensitive sessions whenever feasible.
  • Redact sensitive URL parameters and minimize the content included in natural-language goals.
  • Block localhost, link-local, cloud metadata, and private-network destinations unless the user explicitly authorizes a separately controlled workflow.
  • Apply a domain allowlist for authenticated automation and require confirmation before navigating to a different origin.
  • Use temporary, least-privileged accounts without administrative or billing permissions.
  • Define retention, deletion, access-control, and incident-response requirements for remote session data.
  • Close remote browser sessions promptly and avoid exposing CDP WebSocket URLs in logs or user-visible output.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The top-level skill description says to use TinyFish whenever the user asks to search, find, look up, research, compare, get information from the web, summarize a URL, fetch page content, or automate a website. This is overly broad and can cause the agent to invoke networked web tooling for many ordinary requests without clear necessity checks, increasing data exposure and the chance of unintended browsing or external requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly supports interacting with sites, clicking through pages, filling forms, logging in, collecting structured data, and handling bot-protected pages, but it provides no user-facing warning or safety constraints around credentials, privacy, or account-impacting actions. This creates a substantial risk of collecting sensitive information, performing unintended authenticated actions, or breaching site expectations without informed user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation guidance instructs the agent to use TinyFish whenever a request depends on live web information and explicitly says not to wait for the user to mention TinyFish or scraping. Combined with broad trigger examples and escalation guidance, this encourages default external-tool invocation without strong constraints or consent gates, which can lead to unnecessary data sharing and overreach.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.