ClawHub
Back to skill

Security audit

ProxyClaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real residential-proxy tool, but it asks for broad scraping and long-running network participation with under-disclosed security and privacy risks.

Install only if you deliberately want a residential proxy/scraping tool and understand that use may affect third-party sites, your account quota, and your network reputation. Do not run the rewards Docker node on a personal or sensitive machine without isolating it, pinning/verifying the image, monitoring bandwidth, and knowing how to stop and remove it. Treat IPLOOP_API_KEY and browser tokens as secrets; avoid storing them in localStorage, shell profiles, or plaintext .env downloads when possible, and rotate them if exposed.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)

T06 · System Persistence

Error
Location
SKILL.md:234
Finding

Persistent Third-Party Residential Proxy Node

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
earn/NODE-AGENT.md:9
Finding

Unverified Mutable Container and Standalone Executables

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
fetch.sh:67
Finding

Proxy API Key Exposed Through Process Arguments and Plaintext Proxy Authentication

Content
View full analysis
&2 echo "Get your free key at https://iploop.io/signup.html" >&2 echo "Then: export IPLOOP_API_KEY=\"your_key\"" >&2 exit 1 fi # ── Build proxy auth ── AUTH="iploop:${IPLOOP_API_KEY}" [ -n "$COUNTRY" ] && AUTH="${AUTH}-country-${COUNTRY}" [ -n "$CITY" ] && AUTH="${AUTH}-city-${CITY}" [ -n "$SESSION_ID" ] && AUTH="${AUTH}-session-${SESSION_ID}" [ -n "$ASN" ] && AUTH="${AUTH}-asn-${ASN}" # ── Temp file with guaranteed cleanup ── TMPFILE=$(mktemp) trap 'rm -f "$TMPFILE"' EXIT # ── Fetch ── CURL_OUT=$(curl -s -o "$TMPFILE" -w "%{http_code} %{content_type}" \ --max-time "$TIMEOUT" \ --proxy "http://proxy.iploop.io:8880" \ --proxy-user "$AUTH" \ -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" \ -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" \ -H "Accept-Language: en-US,en;q=0.9" \ "$URL" 2>/dev/null) || { ``` The Skill's security table states: ```markdown | **Secrets handling** | API key passed via `--proxy-user` (not in URL or command line args visible in `ps aux`) | | **Proxy transport** | HTTP proxy protocol — key is encrypted via HTTPS CONNECT tunnel to HTTPS targets | ``` ### Technical Analysis The API key is expanded into the argument supplied to `curl --proxy-user`. Despite the documentation's claim, this is a command-line argument and may be visible through process inspection facilities while `curl` is running, depending on operating-system permissions and process isolation. The proxy endpoint uses `http://proxy.iploop.io:8880`. For HTTP ...[truncated 1752 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
signup.html:254
Finding

Long-Lived Tokens and API Keys Stored in Browser Local Storage and Plaintext Files

Content
View full analysis
> ~/.bashrc source ~/.bashrc ``` The signup page can additionally create an unprotected credential file: ```javascript const blob = new Blob([envContent], { type: 'text/plain' }); const url = URL.createObjectURL(blob); const a = document.createElement('a'); a.href = url; a.download = 'iploop-credentials.env'; a.click(); URL.revokeObjectURL(url); ``` ### Technical Analysis `localStorage` is readable by any JavaScript executing under the same origin. Storing a bearer token and API key there increases the impact of any same-origin cross-site scripting vulnerability or compromised third-party script. The downloaded `.env` file and shell-profile recommendation store reusable API credentials in plaintext. No ...[truncated 1468 chars]
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
signup.html:359
Finding

Connection Test Fabricates a Successful Result Without Network Validation

Content
View full analysis
setTimeout(r, 1500)); result.className = 'test-result success'; result.innerHTML = `

✅ Connection Successful

IP: 104.23.145.67

Country: United States

Latency: 142ms

Your proxy is working correctly!

`; ``` ### Technical Analysis The function constructs a proxy URL but never uses it. The only actual operation is a 1.5-second delay, after which it displays hard-coded IP address, country, latency, and success information. Browser `fetch` does not support the commented `{ proxy: proxyUrl }` option in normal web-page JavaScript, so simply uncommenting that line would not provide a valid implementation. A backend validation service or supported client mechanism is required. This behavior spoofs a legitimate-looking diagnostic tool and can cause users to trust credentials or network configuration that have never been tested. ### Attack Path 1. The user creates an account or receives displayed crede ...[truncated 894 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (98)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description presents the skill as a residential proxy service for routing arbitrary requests through rotating residential IPs. The supplied code instead performs a search query using a SERP-specific API exposed by the IPLoop client and outputs search results. While this may indirectly rely on IPLoop infrastructure, the observable behavior is not general proxy access, request routing, IP rotation management, or geo-restriction bypass for arbitrary traffic. The primary purpose of the code chunk is search retrieval, which is a materially different capability from the declared proxy-access description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The description markets the skill as a residential proxy access service, implying a generic networking/proxy utility. The supplied code is not a general proxy-access wrapper; it is a specific scraper/test harness that targets many named websites, fetches their content, and extracts data such as titles, prices, posts, stock prices, and company info. While use of the IPLoop proxy is consistent with the product theme, the primary implemented behavior is automated browsing/scraping and proxy QA validation across external services. That is a materially different and broader capability than the declared description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

There is a clear description-behavior mismatch. The declared purpose is a residential proxy access skill for routing agent traffic through a large global proxy network. The supplied code does not implement any proxying, request forwarding, IP selection, rotation, authentication to a proxy backend, or bandwidth-sharing features. Instead, it runs a lightweight HTTP server that returns canned support answers based on keyword matching. While the chatbot content discusses IPLoop and ProxyClaw features, the actual behavior is informational customer support, not the advertised proxy capability. This is a materially different primary purpose.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
# 🌐 ProxyClaw by IPLoop

**This is an action skill.** When a user asks to fetch a URL, scrape a site, or use a proxy — execute the request yourself and return the result. Do not just show instructions.

**Expected behaviour:**
- Call `./fetch.sh <URL> [--country CC] [--format markdown]` yourself and return the content

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly directs agents to scrape arbitrary sites through residential proxies and return results, but provides no compliance, privacy, or data-handling guardrails. Residential proxies materially raise abuse potential by masking origin, bypassing geo-controls, and enabling collection of third-party content or personal data at scale, making this context more dangerous than ordinary fetching.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · docs/API.md (reported line 13)May include surrounding context.

POST /auth/register

bash
curl -X POST https://api.iploop.io/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "Pass123!", "firstName": "John", "lastName": "Doe", "company": "Acme"}'

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/API.md (reported line 90)May include surrounding context.

-d '{"name": "My Server", "deviceType": "linux"}'

text

### DELETE /earn/devices/:id
Remove a device.

### GET /earn/cashout/history

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · docs/SUPPORT-API.md (reported line 181)May include surrounding context.

bash
# 1. Register
TOKEN=$(curl -s -X POST https://api.iploop.io/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"bot@example.com","password":"Pass123!","firstName":"Bot","lastName":"Agent"}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['token'])")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · REWARDS.md (reported line 50)May include surrounding context.

docker logs iploop-node

Check gateway sees your node

curl -s https://gateway.iploop.io:9443/health | python3 -m json.tool

text

## Check Your Earnings

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · earn/DOCKER.md (reported line 29)May include surrounding context.

docker logs iploop-node

Check gateway sees your node

curl -s https://gateway.iploop.io:9443/health | python3 -m json.tool

text

## Check Your Earnings

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · earn/DOCKER.md (reported line 36)May include surrounding context.

bash
# Login first
TOKEN=$(curl -s -X POST https://api.iploop.io/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","password":"YourPass"}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['token'])")

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · rules/setup.md (reported line 20)May include surrounding context.

s

  • curl installed (comes pre-installed on most systems)
  • IPLOOP_API_KEY environment variable set

Getting Your API Key

  1. Sign up at iploop.io/signup
  2. Copy your API key from the dashboard
  3. Use code OPENCLAW for 20% off any paid plan
bash
export IPLOOP_API_KEY="your_api_key_here"

To make it permanent, add to your shell profile:

bash
echo 'export IPLOOP_API_KEY="your_api_key"' >> ~/.bashrc
source ~/.bashrc

Verify Connection

bash
./setup.sh

Expected output:

text
✅ IPLOOP_API_KEY is set
✅ Proxy connection successful
✅ ProxyClaw is ready

Markdown Output

For markdown-formatted output, install:

bash
npm install -g node-html-markdown

Then use:

bash
./fetch.sh https://example.com --format markdown

Proxy Endpoint

All requests route through: proxy.iploop.io:8880

Format: http://iploop:API_KEY[-options]@proxy.iploop.io:8880

Troubleshooting

Connection timeout

  • Check if

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · signup.html (reported line 85)May include surrounding context.

html
<div class="feat"><div class="num">~70 GB</div><div class="label">Earn Monthly</div></div>
  </div>

  <!-- STEP 1: Signup Form -->
  <div class="card" id="signup-form">
    <span class="free-badge">✨ 0.5 GB Free — No Credit Card</span>
    <h2>Create Your Account</h2>

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · signup.html (reported line 144)May include surrounding context.

html
<strong>✨ New:</strong> Single API key format — no more customer_id needed! Just copy your key and go.
    </div>

    <button class="btn btn-secondary" onclick="downloadEnv()">📥 Download .env file</button>

    <h3 style="color: #fff; margin: 32px 0 16px; font-size: 16px;">Choose your integration:</h3>

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The page stores the API key and auth token in localStorage, where they are accessible to any script running in the origin, including injected JavaScript from XSS or compromised third-party content. Persisting long-lived secrets this way materially increases the blast radius of any client-side compromise.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · signup.html (reported line 352)May include surrounding context.

html
const url = URL.createObjectURL(blob);
  const a = document.createElement('a');
  a.href = url;
  a.download = 'iploop-credentials.env';
  a.click();
  URL.revokeObjectURL(url);
}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README promotes automatic anti-bot bypass, stealth mode, and scraping of protected sites without any warning about legal, privacy, terms-of-service, or abuse implications. In an agent skill context, this can normalize automated evasion behavior and encourage deployment against targets that did not consent to such access.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 173)May include surrounding context.

Gateway Health

bash
curl https://gateway.iploop.io:9443/health
# → {"connected_nodes": 23000+, "status": "healthy"}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README tells users to run a persistent Docker node to 'share bandwidth' for credits, but does not clearly disclose the security, privacy, abuse-reporting, IP reputation, bandwidth-cost, and resource-consumption risks. This is especially dangerous because it encourages 24/7 operation of software that routes third-party traffic through the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The README instructs users to run a Docker image with the mutable :latest tag and without a pinned digest, which creates a software supply-chain risk. If the upstream image is replaced, compromised, or changed unexpectedly, users may execute unreviewed code on persistent hosts with network access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation states that the agent connects automatically to gateway.iploop.io and then earns credits by remaining online, but it does not clearly warn users that they are enabling ongoing external communications from their system. Because this skill is specifically about residential proxy access and bandwidth contribution, the omitted warning is more dangerous than in ordinary software docs: users may unknowingly expose their device/network to continuous participation in a proxy network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The quick-start instructions tell users to run a persistent container with --restart=always but do not warn about continuous CPU, memory, disk, bandwidth, and security implications of a long-running background service. In the context of a residential proxy node, persistent execution is especially sensitive because the host may continuously contribute network reputation and bandwidth for other parties' traffic.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The Docker command uses the mutable latest tag instead of a pinned version or image digest, which makes the executed code non-reproducible and allows upstream image changes to alter behavior without notice. In a skill that encourages users to run a long-lived networked node, this increases supply-chain risk substantially because a compromised or replaced image could gain persistent execution on the host.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises and instructs use of shell execution, network access, and environment-variable handling, but does not declare an explicit tool/permission scope. That makes the effective privilege boundary unclear and increases the chance an agent invokes this skill with broader capabilities than intended, especially given the skill's instruction to execute requests directly on behalf of the user.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation text is very broad: any request to fetch a URL, scrape a site, or use a proxy should be executed directly. That encourages automatic invocation for common browsing tasks without meaningful user confirmation, policy checks, or domain restrictions, increasing the risk of SSRF-like access patterns, unintended third-party requests, or abusive scraping via the agent.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
signup.html:242