ClawHub
Back to skill

Security audit

web-scraper

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate web-scraping helper, but it can process authenticated browser pages, call a backend AI, run unpinned npm tooling, and save scraped data locally without enough user-facing guardrails.

Review before installing. Use this only on pages you are allowed to scrape, avoid secrets or regulated/internal data unless approved, prefer a pinned and vetted DataLens package version, and clean up exported results or debug logs after use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Unpinned Third-Party npm Package Installation and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–26
Vulnerability Type: Unpinned and immediately executed third-party dependency
Risk Level: Medium

Vulnerable Code:

text
If `datalens-mcp-call` is not on PATH (e.g. not globally installed), use npx:

run_in_terminal: npx datalens-mcp-call <tool_name> '<args_json>'

text

## Prerequisites

1. `datalens-mcp-server` npm package installed: `npm install -g datalens-mcp-server` (or use `npx`).

Technical Analysis

The Skill directs the agent to install or execute an npm dependency without specifying a reviewed version, lockfile, or integrity hash. In particular, npx can download and immediately execute the version currently resolved by the npm registry. The global installation command likewise retrieves an unpinned package and may run its lifecycle scripts.

Consequently, the effective code executed by the Skill can change after the Skill itself has been audited. A compromised publisher account, malicious package release, registry compromise, or dependency-chain compromise could cause arbitrary attacker-controlled code to run locally. The audit found no malicious payload embedded in this project; the risk arises from unsafe dependency acquisition and execution.

Attack Path

  1. An attacker compromises the referenced npm package, its publisher account, or one of its transitive dependencies.
  2. The attacker publishes a malicious release or injects malicious lifecycle/runtime code.
  3. An agent follows SKILL.md and invokes npx datalens-mcp-call or runs npm install -g datalens-mcp-server.
  4. npm resolves and downloads the unpinned package or compromised dependency.
  5. Malicious installation or runtime code executes with the permissions and environment of the agent user.
  6. The payload may access local files, environment variables, browser-related data, or network resources available to that user.

Impact Asses

...[truncated 485 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a specific, reviewed version rather than resolving the latest registry release.
  2. Provide a lockfile and verify package integrity using approved checksums or npm integrity metadata.
  3. Document and verify the expected npm publisher, package repository, and release provenance.
  4. Prefer a vetted local installation over automatic npx retrieval and execution.
  5. Avoid global installation where possible; install into an isolated, least-privileged environment.
  6. Disable npm lifecycle scripts where compatible with the package and deployment process.
  7. Apply dependency scanning and review transitive dependencies before updating the pinned version.
  8. Execute the tooling in a sandbox with restricted filesystem, environment-variable, browser, and network access.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill states that scrape_analyze_columns calls a backend AI to identify fields, but it does not provide a privacy warning that page content and structure may be transmitted off-box to a remote service. When used on authenticated pages, internal dashboards, or personal data, this can exfiltrate sensitive information to a third party without meaningful user awareness or consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger description is broad enough to activate on many generic requests about lists, tables, comments, products, reviews, or repeating webpage data. In an agent setting, overbroad routing increases the chance the skill will run on pages containing sensitive data and perform scraping or browser actions the user did not explicitly intend.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs use of npx datalens-mcp-call without pinning a package version, which allows whatever version is currently resolved from the registry to be executed. That creates a supply-chain risk: a compromised latest release, dependency hijack, or unexpected breaking change could cause arbitrary code execution in the agent environment when the skill is invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill documents commands that write scrape results and debug logs to local files, but it does not clearly warn users that potentially sensitive scraped content, session-derived data, or diagnostic information will persist on disk. This can lead to unintentional local data exposure, especially on shared systems, ephemeral runners with artifact collection, or environments where /tmp is accessible to other processes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.