ClawHub
Back to skill

Security audit

Osint Investigator

Security checks for vulnerabilities and agentic risk

Overview

This OSINT skill is transparent about many reconnaissance tasks, but it needs review because it blends passive OSINT with active scanning/vulnerability-scanner guidance and persistent sensitive reports.

Install only if you intend to use active reconnaissance tooling and can enforce authorization, target validation, and retention controls. Treat harvested emails, domains, IPs, and generated reports as sensitive, and avoid using the active scanning, port scanning, or nuclei-related guidance unless the target owner has explicitly approved it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:108
Finding

Unvalidated Target Injection into the recon-ng Command Stream

Content
View full analysis
Remediation
View remediation
&2 exit 1 ;; esac ``` 2. Apply explicit length and label validation. Each DNS label should be 1–63 characters, and the complete domain should not exceed 253 characters. 3. Reject all carriage-return and newline characters independently, even if broader domain validation is also present: ```bash case "$TARGET" in *$'\n'* | *$'\r'*) echo "Control characters are not permitted" >&2 exit 1 ;; esac ``` 4. Prefer a recon-ng API, structured interface, or parameterized invocation that separates data from console commands. Avoid generating interpreter command streams by interpolating external values into here-documents. 5. If a here-document remains necessary, construct it only after strict allowlist validation. Quoting the here-document delimiter would disable all expansion and therefore requires another safe mechanism for passing validated values. 6. Run recon-ng with least privilege, isolate its workspace, restrict file-system access, and configure only the API keys required for the selected modules. 7. Add negative tests using targets containing newlines, carriage returns, spaces, Unicode control characters, and recon-ng command text to verify that malformed values are rejected before recon-ng starts. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

These usage examples harvest, extract, display, and store email addresses and other identifiers immediately, before any nearby warning about PII handling or authorization. In an OSINT context this increases the chance of collecting personal data without sufficient notice, minimization, or retention controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md
# Whois
echo "--- Whois ---"
curl -s -X POST "http://localhost:8765/aynops/whois" \
  -H "Content-Type: application/json" \
  -d "{\"domain\": \"$TARGET\"}" | jq '{
    registrar: .registrar,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

md
# Whois
echo "--- Whois ---"
curl -s -X POST "http://localhost:8765/aynops/whois" \
  -H "Content-Type: application/json" \
  -d "{\"domain\": \"$TARGET\"}" | jq '{
    registrar: .registrar,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md
# DNS Records
echo ""
echo "--- DNS Records ---"
curl -s -X POST "http://localhost:8765/aynops/dns" \
  -H "Content-Type: application/json" \
  -d "{\"domain\": \"$TARGET\", \"type\": \"all\"}" | jq '{
    a: .A[:5],

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

md
# DNS Records
echo ""
echo "--- DNS Records ---"
curl -s -X POST "http://localhost:8765/aynops/dns" \
  -H "Content-Type: application/json" \
  -d "{\"domain\": \"$TARGET\", \"type\": \"all\"}" | jq '{
    a: .A[:5],

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md
# SSL Certificate Info
echo ""
echo "--- SSL Certificate ---"
curl -s -X POST "http://localhost:8765/aynops/ssl" \
  -H "Content-Type: application/json" \
  -d "{\"domain\": \"$TARGET\"}" | jq '{
    issuer: .issuer,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.

md
# SSL Certificate Info
echo ""
echo "--- SSL Certificate ---"
curl -s -X POST "http://localhost:8765/aynops/ssl" \
  -H "Content-Type: application/json" \
  -d "{\"domain\": \"$TARGET\"}" | jq '{
    issuer: .issuer,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The combined report workflow writes harvested domain intelligence, subdomains, and exposed email addresses into persistent report files under user directories without a nearby disclosure about sensitive-data handling. Persisting OSINT findings increases privacy, compliance, and secondary-exposure risk if those reports are shared or retained insecurely.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 352)May include surrounding context.

md
IP="8.8.8.8"

echo "=== Threat Intel: $IP ==="
curl -s -X POST "http://localhost:8765/aynops/reputation" \
  -H "Content-Type: application/json" \
  -d "{\"ip\": \"$IP\"}" | jq '{
    ip: .ip,

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is presented as OSINT-focused, but the documented 'Attack Surface Discovery' workflow extends into active security assessment activities such as port scanning and technology/CVE correlation. This scope expansion can cause operators to perform intrusive reconnaissance under the guise of passive OSINT, increasing legal and operational risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The security section states the skill is 'Passive by default,' but elsewhere the document describes active scanning features and attack-surface discovery steps. This inconsistency can lead users to underestimate the intrusiveness of the workflow and run active recon without appropriate authorization.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation instructs users to install and use additional tools including nuclei, a vulnerability scanner, despite the skill metadata describing an OSINT investigator. Introducing undisclosed vulnerability-scanning capability broadens the skill into offensive use and may mislead downstream systems or users about the level of access and risk involved.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Mentioning nuclei specifically documents a vulnerability-scanning capability that is not justified by the stated OSINT purpose. That creates a mismatch between declared use and real capability, which can bypass policy expectations and facilitate unauthorized probing.

Content

No source excerpt is available for this finding.