web-scraper-skill Security Audit Report
web-scraper-skill is an AI agent skill. ClawSecure audited web-scraper-skill through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 38 findings concentrate in Supply Chain, Policy Violation and Permissions Manifest, including Vulnerability in lodash@4.17.4: Prototype Pollution in lodash and Vulnerability in minimist@0.0.8: Prototype Pollution in minimist. 20 were rated high or critical severity.
Is web-scraper-skill safe?
ClawSecure audited web-scraper-skill and assigned a security score of 0/100 (High Risk), identifying 38 findings across Supply Chain and Policy Violation. Review the findings below before installing.
What did ClawSecure find in web-scraper-skill?
ClawSecure identified 38 findings in web-scraper-skill, concentrated in Supply Chain, Policy Violation and Permissions Manifest. 20 were rated high or critical severity. The most severe include Vulnerability in lodash@4.17.4: Prototype Pollution in lodash and Vulnerability in minimist@0.0.8: Prototype Pollution in minimist.
How was web-scraper-skill audited?
ClawSecure ran web-scraper-skill through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage.
What does a score of 0 mean?
ClawSecure assigned web-scraper-skill a security score of 0/100, placing it in the High Risk range. This is driven by 38 findings led by Supply Chain that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for web-scraper-skill
ClawSecure detected 38 security findings in web-scraper-skill, spanning Supply Chain, Policy Violation and Permissions Manifest.
- critical · Vulnerability in lodash@4.17.4: Prototype Pollution in lodash. Supply Chain finding detected in
package.json. - critical · Vulnerability in minimist@0.0.8: Prototype Pollution in minimist. Supply Chain finding detected in
package.json. - critical · Vulnerability in xmldom@0.1.27: xmldom allows multiple root nodes in a.... Supply Chain finding detected in
package.json. - high · Vulnerability in lodash@4.17.4: Command Injection in lodash. Supply Chain finding detected in
package.json. - high · Vulnerability in lodash@4.17.4: Prototype Pollution in lodash. Supply Chain finding detected in
package.json. - high · Vulnerability in lodash@4.17.4: Prototype Pollution in lodash. Supply Chain finding detected in
package.json. - high · Vulnerability in node-fetch@2.6.0: node-fetch forwards secure headers.... Supply Chain finding detected in
package.json. - high · Vulnerability in jsonwebtoken@8.3.0: jsonwebtoken unrestricted key type.... Supply Chain finding detected in
package.json. - high · Vulnerability in axios@0.21.0: axios Inefficient Regular Expression.... Supply Chain finding detected in
package.json. - high · Vulnerability in axios@0.21.0: axios Requests Vulnerable To Possible.... Supply Chain finding detected in
package.json. - high · Vulnerability in tar@4.4.0: node-tar Vulnerable to Arbitrary File.... Supply Chain finding detected in
package.json. - high · Vulnerability in tar@4.4.0: Arbitrary File Creation/Overwrite due to.... Supply Chain finding detected in
package.json.
Showing the 12 highest-severity of 38 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for web-scraper-skill
Update and pin dependencies
Resolve policy violations
Add a config.json permissions manifest
Related Security Research
AI Agent Supply Chain Attacks: How Dependencies Become Weapons→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on February 6, 2026. web-scraper-skill is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.