proxy-web-fetch

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:20 PM UTC
• Version:
  1.0.0

Overview

This is a disclosed web-fetching helper that sends user-chosen URLs through an OpenClaw Manager proxy, with no evidence of hidden persistence, destructive behavior, or unrelated access.

Install only if you trust the configured OpenClaw Manager Web Fetch Proxy. Avoid fetching private documents, secret-bearing links, tokenized URLs, localhost/private-network addresses, or regulated content unless your environment has appropriate proxy logging, retention, and network controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger guidance is broad enough that the skill may be invoked for generic requests such as 'read a URL' or 'scrape,' which can cause unintended external network access. In an agent system, over-broad routing increases the chance of fetching attacker-controlled URLs or sensitive internal endpoints when a safer or more constrained tool should have been used.

VirusTotal

66/66 vendors flagged this skill as clean.