ClawHub
Back to skill

Security audit

developer-oss-research

Security checks across malware telemetry and agentic risk

Overview

The skill’s main purpose is legitimate, but its helper can send arbitrary Crawlora API requests beyond the advertised GitHub and Chrome Web Store scope.

Review this before installing if you need strict data-boundary control. The skill is for public OSS and extension research, but queries and identifiers go to Crawlora using your API key, and the bundled helper is broad enough to call unrelated Crawlora endpoints unless the user or agent keeps it to the documented GitHub and Chrome Web Store paths.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The helper explicitly documents support for unrelated Crawlora endpoints such as Amazon, YouTube, Google Search, and Google Trends, while the skill claims to be limited to GitHub and Chrome Web Store research. This creates a capability/scope mismatch that can be abused to exfiltrate arbitrary user-provided queries to third-party services or perform actions outside the reviewed skill boundary.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The file is presented as a generic REST helper rather than a narrowly scoped implementation for the declared skill purpose. In an agent setting, generic network helpers increase the risk of unintended use, because higher-level prompts or wrappers may route arbitrary external requests through this script under the guise of the approved skill.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The reference explicitly documents that requests are sent to an external service with an API key and that user-supplied identifiers and search terms are placed into path/query parameters, but it does not warn operators that this causes third-party transmission of user input. In a research skill that accepts repo names, usernames, org names, and Chrome Web Store identifiers, this omission can lead to unintended disclosure of user-provided data to Crawlora and reduce informed consent around external data handling.

External Transmission

Medium
Category
Data Exfiltration
Content
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).

All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.

**29 endpoints across 2 platform group(s).**
Confidence
90% confidence
Finding
https://api.crawlora.net/

External Transmission

Medium
Category
Data Exfiltration
Content
curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
  [ -n "$body" ] || body="${rest[0]:-{}}"
  curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" -d "$body" "${base}${path}"
fi
Confidence
82% confidence
Finding
curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" -d

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:23