ClawHub
Back to skill

Security audit

agent-directory

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only directory skill that uses a disclosed third-party scraping API; it has privacy considerations but no hidden, persistent, destructive, or purpose-mismatched behavior in the artifacts.

Install only if you are comfortable using a SkillBoss API key and sending requested public directory or skill-file URLs to SkillBoss for scraping. Review any fetched third-party skill.md before allowing an agent to act on it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill includes runnable examples that send authenticated requests to an external API using `SKILLBOSS_API_KEY`, but it does not clearly warn that execution will transmit data off-host to a third-party service. In an agent skill context, users or automated systems may copy or invoke these examples without realizing they are authorizing external access and disclosure of requested URLs/content.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

def pilot(body: dict) -> dict:
    r = requests.post(
        "https://api.heybossai.com/v1/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,
Confidence
90% confidence
Finding
The example shows authenticated external transmission to `https://api.heybossai.com/v1/pilot`, which means any request body and target URL are relayed to a third-party provider. Even though this is documentation, agent operators may execute it directly, causing unreviewed disclosure of data and use of privileged API credentials.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

def pilot(body: dict) -> dict:
    r = requests.post(
        "https://api.heybossai.com/v1/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,
Confidence
90% confidence
Finding
The example shows authenticated external transmission to `https://api.heybossai.com/v1/pilot`, which means any request body and target URL are relayed to a third-party provider. Even though this is documentation, agent operators may execute it directly, causing unreviewed disclosure of data and use of privileged API credentials.

External Transmission

Medium
Category
Data Exfiltration
Content
def pilot(body: dict) -> dict:
    r = requests.post(
        "https://api.heybossai.com/v1/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,
        timeout=60,
Confidence
93% confidence
Finding
This line contains the concrete third-party endpoint used for the outbound request and is part of a live authenticated network call. In this skill's context, the endpoint acts as a scraping hub, so invoking it can disclose both the operator's API key usage and the URLs/content being fetched.

Static analysis

No suspicious patterns detected.