ClawHub
Back to skill

Security audit

upwork-research

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly an Upwork research helper, but its bundled script can call arbitrary Crawlora API paths and methods beyond the documented Upwork-only purpose.

Review before installing. This skill may be acceptable if you trust Crawlora and will only use the documented Upwork endpoints, but the packaged helper is broader than advertised and could consume API credits or send data to unrelated Crawlora endpoints if invoked that way.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill instructs the agent to invoke shell commands (`scripts/crawlora.sh`, `curl`, `jq`) but does not declare permissions or otherwise constrain shell use. Undeclared execution capability increases the chance that the skill can perform actions outside the user's expectations, especially if helper scripts accept arbitrary paths or parameters.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is limited to Upwork research, but the underlying capability appears to allow arbitrary Crawlora API paths and generic POST bodies. That mismatch is dangerous because a user or prompt injection could repurpose the skill to access unrelated Crawlora-backed services or perform broader network actions than the skill description implies.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
This helper is generic to the entire Crawlora API, with examples and interface patterns for unrelated targets such as Amazon, YouTube, and Google, despite the skill being presented as Upwork-only research. That scope mismatch increases the chance the skill can be repurposed to access broader third-party data sources than users or reviewers expect, violating least privilege and making misuse easier.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The script accepts an arbitrary API path and arbitrary HTTP method/body, then forwards them directly to the Crawlora backend with the configured API key. In an Upwork-research skill, this creates an unjustified capability expansion that could be used to query unrelated services, consume credits, or send attacker-controlled payloads to external endpoints exposed by the provider.

External Transmission

Medium
Category
Data Exfiltration
Content
curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
  [ -n "$body" ] || body="${rest[0]:-{}}"
  curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" -d "$body" "${base}${path}"
fi
Confidence
92% confidence
Finding
curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" -d

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:27