ClawHub
Back to skill

Security audit

XCrawl Crawl

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its crawling purpose, but it asks for unnecessary file-editing powers and documents an unsafe TLS default that could expose sensitive crawl credentials.

Review the allowed tools before installing and prefer a version that removes Write/Edit. Use only bounded crawl scopes, be aware that crawl URLs and payloads go to XCrawl, and avoid sending sensitive cookies or headers unless TLS verification is explicitly enabled.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:129
Finding

TLS Certificate Verification Is Disabled by Default

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:129-133
Vulnerability Type: Insecure TLS configuration
Risk Level: Medium

Vulnerable code snippet:

markdown
| `cookies` | object map | No | - | Cookie key/value pairs |
| `headers` | object map | No | - | Header key/value pairs |
| `only_main_content` | boolean | No | `true` | Return main content only |
| `block_ads` | boolean | No | `true` | Attempt to block ad resources |
| `skip_tls_verification` | boolean | No | `true` | Skip TLS verification |

Technical Analysis

The documented default for request.skip_tls_verification is true. The request examples omit this field, so requests may inherit the insecure default. Disabling certificate validation prevents the crawler from authenticating the target HTTPS server and makes crawler-to-target connections vulnerable to man-in-the-middle attacks.

This risk is amplified because the same request configuration accepts arbitrary cookies and headers. If a user submits session cookies, authorization headers, or other target credentials for an authenticated crawl, those values may be transmitted over a connection whose peer certificate is not validated.

Transmission of the XCrawl API key to https://run.xcrawl.com is not itself classified as a vulnerability: it is necessary for the declared hosted API functionality and is directed only to the documented provider endpoint.

Attack Path

  1. A user configures a crawl of an HTTPS target, potentially including authentication cookies or custom headers.
  2. The generated request omits request.skip_tls_verification, as shown in the Skill examples.
  3. The XCrawl service applies the documented default value of true.
  4. An attacker able to intercept or redirect traffic between the crawler and target presents an invalid or attacker-controlled TLS certificate.
  5. The crawler accepts the certificate because verification is disabled.
  6. The attacker can ...[truncated 707 chars]
Remediation
View remediation

Remediation Suggestions

  1. Change the API default for request.skip_tls_verification to false, if the provider controls that behavior.
  2. Explicitly include "skip_tls_verification": false in every cURL, Node.js, and workflow example rather than relying on an upstream default.
  3. Permit disabling verification only after explicit user confirmation for a specific known target, with a warning that credentials and response integrity may be exposed.
  4. Reject or prominently warn against combining disabled TLS verification with cookies, authorization headers, or other sensitive request values.
  5. Add a guardrail requiring certificate verification for normal crawls and document narrowly scoped exceptions for development systems using private certificates.
  6. Prefer configuring a trusted private certificate authority for internal targets instead of bypassing certificate validation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Session Persistence

Medium
Category
Rogue Agent
Confidence
70% confidence
Finding

The skill declares Write and Edit permissions even though its own policy says runtime permissions should be limited to curl and node, and the documented workflow only requires reading local config plus making API calls. Excess file-modification capability expands the blast radius if the skill is misused or prompt-injected, enabling unintended changes to local files or persistence via config tampering.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: xcrawl-crawl
description: Use this skill for XCrawl crawl tasks, including bulk site crawling, crawler rule design, async status polling, and delivery of crawl output for downstream scrape and search workflows.
allowed-tools: Bash(curl:*) Bash(node:*) Read Write Edit Grep
metadata: {"version":"1.0.2","openclaw":{"skillKey":"xcrawl-crawl","homepage":"https://www.xcrawl.com/","requires":{"localFiles":["~/.xcrawl/config.json"],"anyBins":["curl","node"]},"apiKeySource":"local_config"}}
---

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

bash
API_KEY="$(node -e "const fs=require('fs');const p=process.env.HOME+'/.xcrawl/config.json';const k=JSON.parse(fs.readFileSync(p,'utf8')).XCRAWL_API_KEY||'';process.stdout.write(k)")"

CREATE_RESP="$(curl -sS -X POST "https://run.xcrawl.com/v1/crawl" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${API_KEY}" \
  -d '{"url":"https://example.com","crawler":{"limit":100,"max_depth":2},"output":{"formats":["markdown","links"]}}')"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md
const fs=require("fs");
const apiKey=JSON.parse(fs.readFileSync(process.env.HOME+"/.xcrawl/config.json","utf8")).XCRAWL_API_KEY;
const body={url:"https://example.com",crawler:{limit:300,max_depth:3,include:["/docs/.*"],exclude:["/blog/.*"]},request:{locale:"ja-JP"},output:{formats:["markdown","links","json"]}};
fetch("https://run.xcrawl.com/v1/crawl",{
  method:"POST",
  headers:{"Content-Type":"application/json",Authorization:`Bearer ${apiKey}`},
  body:JSON.stringify(body)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The Node example hardcodes request:{locale:"ja-JP"} in natural-language-facing skill documentation. This imposes a specific language/locale choice without indicating that it is optional or user-selected, which conflicts with the policy against forcing a locale absent opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.