ClawHub
Back to skill

Security audit

XCrawl Scrape

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent XCrawl scraping helper, but it should be reviewed because it can send sensitive URLs, headers, cookies, and extraction data to an external service and grants broader file-editing tools than its workflow explains.

Install only if you are comfortable sending scrape targets and any supplied headers, cookies, prompts, and extracted content to XCrawl. Avoid using it on private, authenticated, internal, or regulated pages unless you have approval, protect the local API-key file, and review why the skill is granted Write/Edit permissions before use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: xcrawl-scrape
description: Use this skill for XCrawl scrape tasks, including single-URL fetch, format selection, sync or async execution, and JSON extraction with prompt or json_schema.
allowed-tools: Bash(curl:*) Bash(node:*) Read Write Edit Grep
metadata: {"version":"1.0.2","openclaw":{"skillKey":"xcrawl-scrape","homepage":"https://www.xcrawl.com/","requires":{"localFiles":["~/.xcrawl/config.json"],"anyBins":["curl","node"]},"apiKeySource":"local_config"}}
---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly directs users to send arbitrary target URLs and optional request metadata to a third-party scraping service, but it does not warn that page contents, request headers, cookies, and extracted data may leave the local environment. This creates a real privacy and data-governance risk because users could unintentionally transmit sensitive internal URLs, authenticated content, or regulated data to an external provider.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The cURL sync example sends a target URL and scrape options to a third-party endpoint using a bearer token. This is expected product behavior, but it is still a true security/privacy concern because the skill normalizes transmitting potentially sensitive browsing targets and resulting page content to an external service without prominent warnings or restrictions.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

bash
API_KEY="$(node -e "const fs=require('fs');const p=process.env.HOME+'/.xcrawl/config.json';const k=JSON.parse(fs.readFileSync(p,'utf8')).XCRAWL_API_KEY||'';process.stdout.write(k)")"

curl -sS -X POST "https://run.xcrawl.com/v1/scrape" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${API_KEY}" \
  -d '{"url":"https://example.com","mode":"sync","output":{"formats":["markdown","links"]}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The async cURL example submits scrape jobs and later retrieves results from the third-party provider, extending the exposure window for sensitive target information and extracted content. Although this is intended functionality, it increases operational risk when used with confidential pages because data is stored and processed externally and the skill does not surface retention or sensitivity warnings.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

bash
API_KEY="$(node -e "const fs=require('fs');const p=process.env.HOME+'/.xcrawl/config.json';const k=JSON.parse(fs.readFileSync(p,'utf8')).XCRAWL_API_KEY||'';process.stdout.write(k)")"

CREATE_RESP="$(curl -sS -X POST "https://run.xcrawl.com/v1/scrape" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${API_KEY}" \
  -d '{"url":"https://example.com/product/1","mode":"async","output":{"formats":["json"]},"json":{"prompt":"Extract title and price."}}')"

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The Node example performs a live POST to an external scraping API and includes user-supplied scrape parameters in the transmitted body. In context, this is the core function of the skill rather than covert exfiltration, but it still creates a genuine external-transmission risk if used on sensitive targets or with sensitive headers/cookies because the skill lacks strong consent and data-sensitivity guardrails.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
const fs=require("fs");
const apiKey=JSON.parse(fs.readFileSync(process.env.HOME+"/.xcrawl/config.json","utf8")).XCRAWL_API_KEY;
const body={url:"https://example.com",mode:"sync",output:{formats:["markdown","json"]},json:{prompt:"Extract title and publish date."}};
fetch("https://run.xcrawl.com/v1/scrape",{
  method:"POST",
  headers:{"Content-Type":"application/json",Authorization:`Bearer ${apiKey}`},
  body:JSON.stringify(body)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill instructs users to store and load an API key from a local config file, but it provides no warning about protecting that credential, file permissions, accidental logging, or avoiding disclosure in outputs. While the examples do not intentionally exfiltrate the key beyond the Authorization header, the documentation still under-communicates credential-handling risk for a secret required to access a paid external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The request parameter table specifies a default locale of en-US,en;q=0.9, which imposes a specific language preference by default. The policy allows locale constraints when users are given a choice or when a region-specific justification is documented, neither of which appears here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.