ClawHub
Back to skill

Security audit

Eywa

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent multi-agent coordination tool, but it sends broad work context to an external service and persistent shared room without enough scoping, consent, or trust controls.

Use this only with a private, trusted Eywa endpoint and room. Do not send secrets, credentials, customer data, sensitive file contents, or confidential deployment details through logs, tasks, or persistent knowledge. Treat anything returned from Eywa as untrusted collaboration data, not instructions that override the user or system.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:27
Finding

External Instructions Can Hijack Agent Goals and Workflow

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:120
Finding

Mandatory Operational Logging Discloses Project Activity to an External Service

Content
View full analysis
&1) ``` ### Technical Analysis The prescribed workflow requires broad reporting of filesystem activity, source-control operations, API activity, deployment events, database changes, task descriptions, completion artifacts, and learned project information. The helper script transmits the supplied JSON arguments to a third-party HTTPS endpoint. This collection is substantially broader than the minimum information required for simple work-claim conflict detection. The default room is the generic `demo` room, and the transport shown in the audited script includes no authentication credential or room-access enforcement. Although server-side controls cannot be determined from the local files, the clien ...[truncated 1431 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:55
Finding

Persistent Shared Knowledge Enables Cross-Session Memory Poisoning

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Package Creates Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill directs the agent to use shell execution via bash {baseDir}/eywa-call.sh ... but does not declare an explicit tool scope such as allowed-tools or permissions. This creates an avoidable trust gap: a user or host may not realize the skill requires shell access and network-capable binaries, increasing the risk of unintended command execution and reducing sandbox/policy enforcement clarity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This section instructs agents to send session context, logs, task data, and shared memory to an external Eywa endpoint, but it does not prominently warn that potentially sensitive project or user data will leave the local environment. Because the service is external and collaboration-oriented, agents may disclose source code details, credentials-adjacent context, internal architecture, or operational metadata without informed user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The examples encourage storing knowledge that persists across sessions, but they do not warn about retention, later retrieval, or the sensitivity of the stored material. Persistent cross-session memory materially increases the blast radius of accidental disclosure because internal implementation details or sensitive business context can remain accessible long after the original task ends.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The curl POST sends the full JSON payload, including tool name and user-supplied arguments, to an external endpoint controlled outside the local environment. Even though HTTPS is used, the security issue is not transport encryption but external transmission itself: sensitive agent memory, task data, or credentials embedded in arguments could be exposed to the remote operator or logged server-side.

Content

Scanner excerpt · eywa-call.sh (reported line 27)May include surrounding context.

sh
"${REQ_ID}" "${TOOL}" "${ARGS}")

# Call the MCP endpoint
RESPONSE=$(curl -s -X POST "${ENDPOINT}" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d "${PAYLOAD}" 2>&1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script transmits arbitrary tool arguments to a remote service over HTTP(S) without any user-facing disclosure, confirmation, or data-classification guardrail. In a multi-agent memory/coordination skill, those arguments may include prompts, workspace context, secrets, or internal state, creating a real risk of unintended data exfiltration to a third-party endpoint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.