ClawHub
Back to skill

Security audit

XCrawl Scrape

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent XCrawl scraping helper, but it should be reviewed because it can send sensitive URLs, headers, cookies, and extraction data to an external service and grants broader file-editing tools than its workflow explains.

Install only if you are comfortable sending scrape targets and any supplied headers, cookies, prompts, and extracted content to XCrawl. Avoid using it on private, authenticated, internal, or regulated pages unless you have approval, protect the local API-key file, and review why the skill is granted Write/Edit permissions before use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: xcrawl-scrape
description: Use this skill for XCrawl scrape tasks, including single-URL fetch, format selection, sync or async execution, and JSON extraction with prompt or json_schema.
allowed-tools: Bash(curl:*) Bash(node:*) Read Write Edit Grep
metadata: {"version":"1.0.2","openclaw":{"skillKey":"xcrawl-scrape","homepage":"https://www.xcrawl.com/","requires":{"localFiles":["~/.xcrawl/config.json"],"anyBins":["curl","node"]},"apiKeySource":"local_config"}}
---
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly directs users to send arbitrary target URLs and optional request metadata to a third-party scraping service, but it does not warn that page contents, request headers, cookies, and extracted data may leave the local environment. This creates a real privacy and data-governance risk because users could unintentionally transmit sensitive internal URLs, authenticated content, or regulated data to an external provider.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
API_KEY="$(node -e "const fs=require('fs');const p=process.env.HOME+'/.xcrawl/config.json';const k=JSON.parse(fs.readFileSync(p,'utf8')).XCRAWL_API_KEY||'';process.stdout.write(k)")"

curl -sS -X POST "https://run.xcrawl.com/v1/scrape" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${API_KEY}" \
  -d '{"url":"https://example.com","mode":"sync","output":{"formats":["markdown","links"]}}'
Confidence
94% confidence
Finding
The cURL sync example sends a target URL and scrape options to a third-party endpoint using a bearer token. This is expected product behavior, but it is still a true security/privacy concern because the skill normalizes transmitting potentially sensitive browsing targets and resulting page content to an external service without prominent warnings or restrictions.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
API_KEY="$(node -e "const fs=require('fs');const p=process.env.HOME+'/.xcrawl/config.json';const k=JSON.parse(fs.readFileSync(p,'utf8')).XCRAWL_API_KEY||'';process.stdout.write(k)")"

CREATE_RESP="$(curl -sS -X POST "https://run.xcrawl.com/v1/scrape" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${API_KEY}" \
  -d '{"url":"https://example.com/product/1","mode":"async","output":{"formats":["json"]},"json":{"prompt":"Extract title and price."}}')"
Confidence
94% confidence
Finding
The async cURL example submits scrape jobs and later retrieves results from the third-party provider, extending the exposure window for sensitive target information and extracted content. Although this is intended functionality, it increases operational risk when used with confidential pages because data is stored and processed externally and the skill does not surface retention or sensitivity warnings.

External Transmission

Medium
Category
Data Exfiltration
Content
const fs=require("fs");
const apiKey=JSON.parse(fs.readFileSync(process.env.HOME+"/.xcrawl/config.json","utf8")).XCRAWL_API_KEY;
const body={url:"https://example.com",mode:"sync",output:{formats:["markdown","json"]},json:{prompt:"Extract title and publish date."}};
fetch("https://run.xcrawl.com/v1/scrape",{
  method:"POST",
  headers:{"Content-Type":"application/json",Authorization:`Bearer ${apiKey}`},
  body:JSON.stringify(body)
Confidence
94% confidence
Finding
The Node example performs a live POST to an external scraping API and includes user-supplied scrape parameters in the transmitted body. In context, this is the core function of the skill rather than covert exfiltration, but it still creates a genuine external-transmission risk if used on sensitive targets or with sensitive headers/cookies because the skill lacks strong consent and data-sensitivity guardrails.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The skill instructs users to store and load an API key from a local config file, but it provides no warning about protecting that credential, file permissions, accidental logging, or avoiding disclosure in outputs. While the examples do not intentionally exfiltrate the key beyond the Authorization header, the documentation still under-communicates credential-handling risk for a secret required to access a paid external service.

Natural-Language Policy Violations

Low
Confidence
96% confidence
Finding
The request parameter table specifies a default `locale` of `en-US,en;q=0.9`, which imposes a specific language preference by default. The policy allows locale constraints when users are given a choice or when a region-specific justification is documented, neither of which appears here.

Static analysis

No suspicious patterns detected.