crw-self-host

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill contains examples that embed API keys and credentials inline (env var assignments, proxy URLs, and api_key fields), which would require an LLM to echo or include secret values verbatim if real keys/passwords are filled in.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL describes crw-self-host’s /v1/scrape and /v1/search endpoints and the crw-mcp MCP integration, where outsider-provided url/query inputs can be submitted to the service at runtime for LLM extraction.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README includes installer/runtime commands that fetch and execute remote artifacts (e.g., curl -fsSL https://fastcrw.com/install | CRW_BINARY=crw sh and docker run -i ghcr.io/us/crw) which download and run code from external hosts.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill includes explicit sudo commands that write to system keyrings and /etc/apt sources and runs apt install, i.e. instructions that modify system files and require elevated privileges.