tinyfish

ISSUES FOUND max severity CRITICALSkillSpector Do not install 75 registry clawhub.ai last scanned 2026-02-07 1 scan

4 findings (1 critical, 2 high, 1 medium), mainly data exfiltration, social engineering, resource abuse. Most recent scan 2026-02-07.

This skill presents CRITICAL and HIGH security risks primarily related to data exfiltration and credential exposure. The skill acts as a wrapper for an external third-party service (mino.ai) but fails to adequately disclose this dependency or the security implications. Key concerns: (1) Transmits user API credentials to external service, (2) Sends all scraped data to third-party without user confirmation or content filtering, (3) Misleading description that doesn't disclose third-party dependency, (4) Lacks timeout controls that could cause resource exhaustion. The skill requires immediate security improvements before production use, particularly around data transmission transparency, user consent, and credential handling.
Scanner's overall assessment (LLM analyzer)

Findings4

Critical1

High2

Medium1

Low0

Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictDo not install 75

Score75 / 100

Issues4

CategoriesData Exfiltration Data Flow MCP Least Privilege

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Use TinyFish/Mino web agent to extract/scrape websites, extract data, and automate browser actions using natural language. Use when you need to extract/scrape data from websites, handle bot-protected sites, or automate web tasks.

Package: 2 files, 5.6 KB
SKILL.md: 318 words, 10 sections
Code: Python (1)

SKILL.md covers: TinyFish Web Agent · Best Practices · Basic Extract/Scrape · Multiple Items · Stealth Mode · Proxy · Output · Parallel Extraction · Compare pizza prices - run these simultaneously · Don't do this - less reliable and slower

Findings

CRITICAL Hardcoded API Key Exposure Risk Data Exfiltrationllm

The skill requires MINO_API_KEY environment variable and transmits it to external service mino.ai. While the key itself isn't hardcoded, the skill creates a direct channel for credential transmission to a third-party service. If the environment variable is compromised or the external service is malicious, this enables credential theft and unauthorized API usage.

scripts/extract.py

api_key = os.environ.get("MINO_API_KEY")
req = urllib.request.Request(
    "https://mino.ai/v1/automation/run-sse",
    headers={
        "X-API-Key": api_key,
        "Content-Type": "application/json",
    }
)

Remediation: 1. Validate the mino.ai service is legitimate and trustworthy. 2. Implement API key validation before transmission. 3. Add user confirmation before sending credentials to external services. 4. Document the third-party dependency clearly in the manifest. 5. Consider implementing key rotation mechanisms.

HIGH Unrestricted Data Exfiltration to External Service Data Exfiltrationllm

The skill sends arbitrary user-specified URLs and extraction goals to external service mino.ai without validation or user confirmation. This creates a data exfiltration channel where sensitive information from scraped websites (potentially including credentials, PII, or proprietary data) is automatically transmitted to a third-party service. The skill provides no transparency about what data is collected or how it's used by mino.ai.

scripts/extract.py

payload = {
    "url": url,
    "goal": goal,
}
req = urllib.request.Request(
    "https://mino.ai/v1/automation/run-sse",
    data=json.dumps(payload).encode()
)
with urllib.request.urlopen(req) as response:

Remediation: 1. Add explicit user confirmation before sending data to external services. 2. Implement content filtering to prevent transmission of sensitive data patterns (credentials, API keys, PII). 3. Provide clear documentation about data transmission to third parties. 4. Add option for local-only processing. 5. Implement audit logging of all external transmissions.

HIGH Misleading Skill Description - Undisclosed Third-Party Dependency Social Engineeringllm

The skill description claims to 'extract/scrape websites' and 'automate browser actions' but fails to disclose that it's actually a wrapper around an external third-party service (mino.ai). Users may believe the skill performs local web scraping when it actually sends all requests and data to an external API. This is deceptive and prevents informed consent about data sharing with third parties.

SKILL.md

Description: Use TinyFish/Mino web agent to extract/scrape websites, extract data, and automate browser actions using natural language.

Actual behavior: All requests proxied through https://mino.ai/v1/automation/run-sse

Remediation: 1. Update description to clearly state: 'Wrapper for mino.ai third-party web scraping service'. 2. Add explicit disclosure about data transmission to external services. 3. Document mino.ai's data handling policies. 4. Add privacy implications to the description. 5. Require explicit user consent before first use.

MEDIUM Unbounded Network Request Without Timeout Resource Abusellm

The script uses urllib.request.urlopen() without specifying a timeout parameter. This can cause the agent to hang indefinitely if the external service (mino.ai) becomes unresponsive, leading to resource exhaustion and denial of service for the agent. The streaming response handling also lacks timeout controls.

scripts/extract.py:54

with urllib.request.urlopen(req) as response:
    for line in response:
        # Streaming without timeout controls

Remediation: 1. Add timeout parameter to urlopen: urllib.request.urlopen(req, timeout=30). 2. Implement maximum response time limits for streaming. 3. Add retry limits with exponential backoff. 4. Implement circuit breaker pattern for repeated failures. 5. Add resource usage monitoring.

What is in the package

File	Kind	Size
`SKILL.md`	doc	3.0 KB
`scripts/extract.py`	script	2.6 KB

External hosts referenced

mino.ai pizzahut.com site.com dominos.com geo-restricted-site.com protected-site.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

MINO_API_KEY

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/tinyfish-web-agent
Raw scan result: tinyfish-web-agent-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-tinyfish.svg)
Request a re-scan