Security audit

ProxyClaw

Security checks across malware telemetry and agentic risk

Overview

ProxyClaw is a real residential-proxy scraping skill, but it needs Review because it encourages broad proxy-routed scraping, anti-bot bypass, persistent bandwidth sharing, and account or payout actions without enough user consent and risk controls.

Install only if you intentionally want a third-party residential proxy and scraping tool. Do not send secrets, internal URLs, authenticated sessions, customer data, or regulated data through it without explicit approval. Avoid the Docker or binary bandwidth-sharing node unless you accept that your residential IP and bandwidth may relay third-party traffic. Treat device registration and cashout examples as manual account operations, not agent automation, and avoid storing long-lived keys in shell history, localStorage, or synced dotfiles.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises and instructs use of environment variables, shell execution, and outbound network access, but the metadata does not declare corresponding permissions. This creates a transparency and governance gap: a host may invoke the skill without clear notice that it will execute commands and route traffic to third-party endpoints through residential proxies.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documentation exposes capabilities well beyond simple proxy routing, including account creation and participation in a bandwidth-sharing rewards system. In an agent-skill context, this broadens the action surface from network access to autonomous account lifecycle and monetization behavior, which can lead to unauthorized enrollment or unintended use of local/network resources.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Cash-out and payout operations are financially sensitive and are not necessary for a proxy-routing skill. If an agent were allowed to invoke these endpoints, it could redirect earned funds or trigger withdrawals without clear user intent, creating direct financial and account-integrity risk.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The quick-start explicitly instructs automated registration of accounts, enrollment of earning devices, and cash-out actions. This encourages agents to perform identity, resource-sharing, and financial operations automatically, which is materially more dangerous than simple proxy configuration.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The FAQ asserts the node has no access to the local network, but the documented Docker run/compose examples give the container normal default networking and outbound connectivity. This is misleading because a compromised or malicious proxy node could probe local services or route third-party traffic in ways that affect the host network and privacy assumptions.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The documentation states 'No personal data collected' even though a residential proxy node necessarily exposes the operator's IP address, coarse location, ISP/network metadata, and causes third-party traffic to transit their connection. That claim can materially mislead users about privacy consequences and informed consent, especially in a product whose core function is reselling residential bandwidth.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The UI presents a connection test as if it validates the proxy, but the implementation explicitly simulates success instead of performing a real check. This can mislead users into believing credentials and network routing work correctly, causing unsafe operational decisions and masking setup or service failures.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README instructs users to export an API key and shows proxy authentication embedded directly in command lines without warning that secrets may leak via shell history, terminal logs, CI logs, screenshots, or process lists. In a proxy tool used by agents and automation, this increases the likelihood of credential exposure and unauthorized proxy usage or account abuse.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The agent example directs autonomous scraping of a competitor website without any caution about authorization, terms of service, robots restrictions, personal data, or responsible use. Because this skill is explicitly designed for anti-bot bypass and agent-driven collection, the context makes misuse more likely and lowers the barrier to policy-violating or legally risky scraping.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document explicitly encourages users to run a long-lived node agent that connects to a vendor-controlled gateway and may route third-party traffic, but it does not clearly disclose bandwidth usage, IP reputation risks, legal/compliance exposure, resource consumption, or privacy implications. In the context of a residential proxy network, omission of these warnings is security-relevant because users may unknowingly turn their device/network into an exit node for others' traffic.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger language is very broad: any request to fetch a URL, scrape a site, or use a proxy should be executed automatically by the agent. Broad autonomous triggers increase the chance of unintended invocation, causing the agent to make network requests or scrape targets without adequate user confirmation, policy checks, or contextual safety review.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to autonomously execute proxy-routed fetching and scraping and return results, but it does not require a clear warning that user-requested URLs and traffic will transit a third-party residential proxy network. This can expose sensitive browsing targets, internal endpoints, or regulated content to external infrastructure without informed user consent.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The manifest description advertises the skill as a generic residential proxy for AI agents without stating any activation boundaries, allowed-use constraints, or approval requirements. In an agent ecosystem, that broad framing can encourage autonomous use for arbitrary outbound web activity, increasing the risk of misuse for scraping, access control bypass, or policy-violating network actions.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The metadata explicitly promotes anti-detection features including TLS/JA3 and Chrome fingerprinting, which are commonly used to evade bot detection and frustrate defensive monitoring. In the context of an AI-agent skill, advertising these capabilities without strong policy guardrails materially increases the likelihood of abusive automation, stealth scraping, and bypass of site protections.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The documentation presents destructive and sensitive actions such as device removal and cash-out without any warning about impact, authorization expectations, or recovery limitations. In an agent setting, omission of these guardrails increases the chance of accidental or unsafe execution of account-affecting operations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The quick-start normalizes account creation, device registration, balance checking, proxy use, and payout actions in one unattended workflow without privacy, billing, or consent warnings. This framing makes misuse more likely because agents may treat all steps as routine initialization.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation includes authenticated API calls for usage, dashboard, API keys, earnings, device registration, and cashout actions, but provides no warning that bearer tokens and returned data are sensitive. In an agent context, this increases the chance that logs, prompts, shell history, or downstream tooling expose credentials or financial/account data, and that bots invoke money-moving endpoints without explicit safeguards.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The quick-start instructs bots to register accounts and register earning devices without warning that these are state-changing actions. In agent-driven workflows, examples like this can be executed automatically, causing unintended account creation, resource enrollment, or billing/earnings side effects.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The file encourages users to run a bandwidth-sharing proxy container immediately, but does not prominently warn that this exposes their IP/bandwidth for third-party traffic and may create privacy, abuse, policy, or resource-consumption risks. In the context of a residential proxy product, that omission is material because users may underestimate legal and operational consequences.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The login example places the password directly in a shell command, which can leak through shell history, process listings, terminal logging, or copy/paste into automation. This creates unnecessary credential exposure for a service that also returns a bearer token used for account access.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The guide encourages users to run a bandwidth-sharing agent that proxies third-party traffic through their residential IP, but it does not give a prominent warning about abuse complaints, account or ISP action, geo/legal exposure, bandwidth consumption, or reputational risk from traffic appearing to originate from the user's network. In this skill context, that omission is more dangerous because the product explicitly markets residential proxy capacity and automated installation, increasing the chance that users deploy it without understanding the consequences.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script sends all requested URLs and resulting traffic through a third-party residential proxy service using the user's API key, but it does not present a clear runtime warning or consent prompt about that data flow. This is dangerous because requested URLs, destination metadata, response content, and potentially embedded credentials or sensitive query parameters may be exposed to the proxy provider or processed on untrusted intermediary infrastructure.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger/description text is broad enough to activate the skill for generic 'site scraping', 'data extraction', and 'anti-bot bypass' requests, which can cause the agent to invoke a high-risk proxy scraping capability outside narrowly intended QA use. In this context, overbroad activation is especially concerning because the skill explicitly supports residential proxy routing and anti-bot evasion across many third-party sites, increasing the chance of policy-violating or privacy-impacting use.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill advertises routing traffic through IPLoop residential proxies and third-party anti-bot tooling but does not clearly warn users that request contents, target URLs, metadata, and potentially scraped data will transit external infrastructure. That omission is dangerous because users may unknowingly send sensitive queries or data through a proxy network designed to bypass geo-restrictions and anti-bot defenses, creating privacy, compliance, and misuse risks.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide tells users to persist a plaintext API key in `~/.bashrc`, which increases the chance of accidental credential exposure through shell history, dotfile syncing, backups, screenshots, or local multi-user access. While this is common setup guidance, it lacks any warning about secret-handling risks or safer alternatives, so it is a real security weakness in documentation.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: signup.html:242