ClawHub
Back to skill

Security audit

Meerkat Governance

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for AI governance, but it sends potentially sensitive content to an external service while giving inconsistent statements about raw-content retention and audit retrieval.

Install only if you are comfortable sending selected content to Meerkat's API and have checked the provider's privacy terms. Avoid sending secrets, regulated records, or confidential business data unless your organization has approved the service and understands audit retention and retrieval behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The file claims raw content is discarded and not retained, but later says the audit endpoint can retrieve the full record and that content is kept for an audit-trail retention period. These contradictory statements can mislead operators into sending sensitive data under false assumptions, creating privacy, compliance, and unintended retention risk.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The manifest states the skill has two API endpoints, but the documentation later exposes a third `/v1/audit/<audit_id>` endpoint. This mismatch can cause developers, reviewers, or policy engines to underestimate the skill's external capabilities and data access surface, especially because the audit endpoint can retrieve stored records from prior submissions.

External Transmission

Medium
Category
Data Exfiltration
Content
The `/v1/shield` endpoint scans content for prompt injection, jailbreaks, data exfiltration, and social engineering. The agent can call this before processing content the developer designates as untrusted. Common examples include external emails, web-scraped content, and user-uploaded documents. Developers can optionally configure their agent to shield skill descriptions before installation.

```bash
curl -s -X POST https://api.meerkatplatform.com/v1/shield \
  -H "Authorization: Bearer $MEERKAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"input\": \"<THE_CONTENT>\"}"
Confidence
86% confidence
Finding
The `/v1/shield` example sends externally sourced content to `api.meerkatplatform.com`, which is an external transmission of potentially sensitive or malicious data. While external API use is the skill's intended function, it still creates confidentiality and compliance risk because uploaded emails, documents, or scraped data leave the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
The `/v1/shield` endpoint scans content for prompt injection, jailbreaks, data exfiltration, and social engineering. The agent can call this before processing content the developer designates as untrusted. Common examples include external emails, web-scraped content, and user-uploaded documents. Developers can optionally configure their agent to shield skill descriptions before installation.

```bash
curl -s -X POST https://api.meerkatplatform.com/v1/shield \
  -H "Authorization: Bearer $MEERKAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"input\": \"<THE_CONTENT>\"}"
Confidence
86% confidence
Finding
The `/v1/shield` example sends externally sourced content to `api.meerkatplatform.com`, which is an external transmission of potentially sensitive or malicious data. While external API use is the skill's intended function, it still creates confidentiality and compliance risk because uploaded emails, documents, or scraped data leave the local environment.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs agents to transmit user requests, AI outputs, and source context to an external API, but the warning about data leaving the environment and appearing in audit records is incomplete and inconsistent. This is dangerous because sensitive prompts, source documents, or regulated data may be exported off-platform without informed consent or appropriate handling expectations.

External Transmission

Medium
Category
Data Exfiltration
Content
The `/v1/verify` endpoint checks AI-generated output against source data using up to five ML checks: entailment (DeBERTa NLI), numerical verification, semantic entropy, implicit preference detection, and claim extraction.

```bash
curl -s -X POST https://api.meerkatplatform.com/v1/verify \
  -H "Authorization: Bearer $MEERKAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"input\": \"<USER_REQUEST>\", \"output\": \"<AI_OUTPUT>\", \"context\": \"<SOURCE_DATA>\", \"domain\": \"<DOMAIN>\"}"
Confidence
90% confidence
Finding
The `/v1/verify` endpoint transmits user input, AI output, and source context to an external service, potentially including highly sensitive business, legal, healthcare, or financial information. In this skill's context, that is materially risky because the endpoint is specifically designed to inspect exactly the kinds of data that may be confidential or regulated.

External Transmission

Medium
Category
Data Exfiltration
Content
Every shield and verify call is logged with an audit ID. The `/v1/audit/<audit_id>` endpoint retrieves the full record. Add `?include_session=true` to see all linked attempts in a retry session.

```bash
curl -s https://api.meerkatplatform.com/v1/audit/<audit_id> \
  -H "Authorization: Bearer $MEERKAT_API_KEY"
```
Confidence
81% confidence
Finding
The audit retrieval endpoint enables external access to previously logged records, expanding the exposure from one-time submission to later retrieval of stored audit data. This increases the sensitivity of prior transmissions because retained records may be fetched again, broadening the privacy and governance implications if operators were led to believe content was not retained.

Static analysis

No suspicious patterns detected.