Pub Autoupd

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:43 PM UTC
• Version: 1.0.0

Overview

This package is presented as an auto-updater but actually documents a broad third-party AI, media, search, email, and SMS gateway that can send user data outside the local environment.

Install only if you intend to use a broad SkillBoss API gateway, not an automatic updater. Before use, confirm who operates api.heybossai.com, what data and providers your SKILLBOSS_API_KEY can access, whether email/SMS actions are authorized and rate-limited, and where the run.mjs helper comes from. Do not treat this package as a safe updater until its name, description, implementation, privacy disclosure, and executable provenance are corrected.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.md:1
• Finding: Skill Metadata Misrepresents the Implemented Functionality## Vulnerability Details **File Location**: `SKILL.md`, lines 1-5 **Vulnerability Type**: Deceptive Skill Metadata **Risk Level**: Medium ### Vulnerable Code ```yaml --- name: auto-updater description: "Automatically update Clawdbot and all installed skills once daily via cron. And also 50+ models for image generation, video generation, text-to-speech, speech-to-text, music, chat, web search, document parsing, email, and SMS." allowed-tools: Bash, Read metadata: {"clawdbot":{"requires":{"env":["SKILLBOSS_API_KEY"]},"primaryEnv":"SKILLBOSS_API_KEY"}} ``` ### Technical Analysis The Skill is named `auto-updater` and claims that it automatically updates Clawdbot and installed skills through a daily cron task. However, the audited package contains no updater implementation, cron configuration, scheduled-task installation command, or update workflow. The actual instructions describe an external AI service gateway and direct the Agent to send prompts, images, audio, documents, email content, phone numbers, and OTP values to `https://api.heybossai.com/v1`. This metadata mismatch can cause a user or an automated Agent to select the Skill for an update-related purpose while loading functionality unrelated to updating. The requested `Bash` capability and API credential further increase the consequences of loading the Skill under a false expectation. No implemented persistence mechanism was found. Therefore, the cron claim is deceptive metadata rather than a confirmed `T06: System Persistence` vulnerability. ### Attack Path 1. A user or Agent searches for a Skill that automatically updates Clawdbot or installed skills. 2. The package is selected because its name is `auto-updater` and its description claims daily cron-based updates. 3. The Skill is loaded with access to `Bash`, `Read`, and the `SKILLBOSS_API_KEY` environment variable. 4. Instead of performing an update, the instructions direct requests and task data to the external SkillBoss API. 5. If the Agent fo ...[truncated 819 chars]
• Remediation: ## Remediation Suggestions 1. Rename the Skill to accurately describe its function, such as `skillboss-api` or `multimodal-model-gateway`. 2. Remove the unsupported claim that the Skill updates Clawdbot or installs a daily cron task. 3. If update functionality is intended, provide a separate, auditable implementation that: - Identifies exactly what will be updated. - Requires explicit user approval before changing files or installing scheduled tasks. - Uses authenticated and integrity-verified update sources. - Documents rollback and removal procedures. 4. Clearly disclose that user-provided content is transmitted to `api.heybossai.com` and may be routed to additional model providers. 5. Describe the categories of data that may leave the local environment, including documents, recordings, images, phone numbers, OTP values, and email content. 6. Reduce `allowed-tools` to the minimum needed. If direct HTTP tooling is available, avoid granting unrestricted shell access solely to run `curl`.

T08 · Insecure Dependencies

Warning

• Location: audio-models.md:29
• Finding: Unspecified run.mjs Executable Can Be Resolved from an Untrusted PATH## Vulnerability Details **File Locations**: - `audio-models.md`, lines 29-32 - `chat-models.md`, lines 31-33 - `image-models.md`, lines 22-24 - `video-models.md`, lines 9-11 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code From `audio-models.md`, lines 29-32: ```bash run.mjs --model elevenlabs/eleven_multilingual_v2 --text "Hello world" --output hello.mp3 run.mjs --model openai/whisper-1 --file recording.m4a run.mjs --model replicate/meta/musicgen --prompt "upbeat electronic" --duration 30 --output track.mp3 ``` From `chat-models.md`, lines 31-33: ```bash run.mjs --model bedrock/claude-4-5-sonnet --prompt "Explain quantum computing" run.mjs --model openai/gpt-4o-mini --prompt "Summarize this" --context "Be concise" ``` From `image-models.md`, lines 22-24: ```bash run.mjs --model mm/img --prompt "A sunset over mountains" --output sunset.png run.mjs --model vertex/gemini-3-pro-image-preview --prompt "A cat" --output cat.png ``` From `video-models.md`, lines 9-11: ```bash run.mjs --model mm/t2v --prompt "A cat playing" --output video.mp4 run.mjs --model mm/i2v --prompt "Zoom in slowly" --image "https://example.com/photo.jpg" --output video.mp4 ``` ### Technical Analysis The documentation repeatedly instructs the Agent to execute a command named `run.mjs`. The audited project does not contain this file and does not specify: - The package or repository that supplies it. - A trusted installation source. - A fixed filesystem path. - A version or immutable revision. - A checksum or signature. - The runtime through which it should be invoked. When a bare command is executed through a shell, the operating system generally resolves it using the current `PATH`. Consequently, an unrelated or attacker-controlled executable named `run.mjs` may be selected. Depending on the environment, the current working directory, user-writable binary directories, or compromised dependency directories may take precedence over a le ...[truncated 2149 chars]
• Remediation: ## Remediation Suggestions 1. Bundle the required implementation inside the Skill package and subject it to the same security review as the documentation. 2. Invoke the script through a canonical path rather than shell `PATH` resolution, for example: ```bash node "/trusted/skill-directory/scripts/run.mjs" ... ``` 3. Document the script’s authoritative repository, publisher, license, and expected cryptographic hash. 4. Pin the implementation to an immutable version or commit and verify its checksum or digital signature before use. 5. Do not instruct users to install an unversioned package or download and immediately execute remote code. 6. Validate the runtime and script path before execution: - Confirm that the path is not user-replaceable by untrusted parties. - Reject symbolic links where inappropriate. - Check file ownership and permissions. 7. Run the helper with least privilege and a minimal environment. Pass only the specific API key it requires rather than inheriting all Agent secrets. 8. Avoid exposing sensitive content in process arguments when feasible, because command-line arguments may be visible to other local processes. Prefer standard input or a permission-restricted temporary input file with secure cleanup. 9. Add explicit error handling so that missing or unexpected executables cause the operation to stop rather than falling back to an arbitrary command.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (35)

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The manifest and description claim this is an automatic updater, but the file actually exposes a broad third-party API wrapper for chat, media, search, document processing, email, and SMS. That mismatch is dangerous because users or higher-level policy may grant or trust the skill under a narrow updater purpose while it enables unrelated external actions and data flows.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Generative AI, search, scraping, and document-processing operations are unjustified for a skill represented as an updater and can cause arbitrary user content to be transmitted to a third party. The misleading updater context makes this more dangerous because operators may permit it without realizing it can exfiltrate prompts, documents, audio, or web-derived data externally.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Email sending and SMS/OTP flows are unrelated to automatic software updating and introduce external-communication capability that could be abused for spam, phishing, account-verification abuse, or unauthorized notifications. In the context of a purported updater, these capabilities are especially suspicious because they expand the action surface far beyond user expectations.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 74% confidence
• Finding: The file establishes a third-party base URL and bearer-token authentication for broad external service use. That creates a general-purpose network egress and delegated-processing channel inconsistent with an automatic updater's declared purpose.

External Transmission

Medium

• Category: Data Exfiltration

Content

## List Models

```bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"
```

• Confidence: 79% confidence
• Finding: This models-list request contacts a third-party API and transmits an authorization token. While low risk in isolation, it contributes to a broader undeclared external-integration pattern in a skill that is supposed to perform updates only.

External Transmission

Medium

• Category: Data Exfiltration

Content

## List Models

```bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"
```

• Confidence: 79% confidence
• Finding: This models-list request contacts a third-party API and transmits an authorization token. While low risk in isolation, it contributes to a broader undeclared external-integration pattern in a skill that is supposed to perform updates only.

External Transmission

Medium

• Category: Data Exfiltration

Content

Filter by type:

```bash
curl -s "https://api.heybossai.com/v1/models?types=image" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"
```

• Confidence: 79% confidence
• Finding: Filtering models by type still performs unnecessary third-party communication for a non-updater feature set. The main danger is hidden external connectivity and feature creep under a misleading label.

External Transmission

Medium

• Category: Data Exfiltration

Content

Get full docs for specific models:

```bash
curl -s "https://api.heybossai.com/v1/models?ids=mm/img,bedrock/claude-4-5-sonnet" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"
```

• Confidence: 79% confidence
• Finding: Fetching model docs from the external API discloses use of a broad AI gateway unrelated to update automation. This increases the gap between stated purpose and actual external functionality.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill omits privacy disclosures for chat, speech, document, and search operations that send potentially sensitive user content to a third-party API. In a skill mislabeled as an updater, this omission is more dangerous because users are less likely to realize their data may leave the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Chat

```bash
curl -s -X POST https://api.heybossai.com/v1/chat/completions \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 87% confidence
• Finding: The chat-completions request sends user messages to a third-party service for processing. In the context of an auto-updater skill, this is unjustified data egress and can expose sensitive prompts or operational data unexpectedly.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Image Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 86% confidence
• Finding: This image-generation call forwards user prompts externally, which is outside the claimed updater purpose. That mismatch makes even ordinary API usage a security concern because users may not expect data sharing or added functionality.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Image Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 86% confidence
• Finding: This image-generation call forwards user prompts externally, which is outside the claimed updater purpose. That mismatch makes even ordinary API usage a security concern because users may not expect data sharing or added functionality.

External Transmission

Medium

• Category: Data Exfiltration

Content

Save to file:

```bash
URL=$(curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \

• Confidence: 84% confidence
• Finding: This workflow both submits a prompt to a third-party API and downloads a returned file URL, expanding the external interaction surface. In a deceptive updater context, that can enable unnoticed content retrieval from remote locations.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Video Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 86% confidence
• Finding: The video-generation endpoint sends prompt data externally for unrelated processing. Its presence in an updater skill materially increases the risk of hidden data egress and unapproved capabilities.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Video Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 86% confidence
• Finding: The video-generation endpoint sends prompt data externally for unrelated processing. Its presence in an updater skill materially increases the risk of hidden data egress and unapproved capabilities.

External Transmission

Medium

• Category: Data Exfiltration

Content

Image-to-video:

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 86% confidence
• Finding: The image-to-video example sends both prompt text and an image URL to an external provider. This can expose user-controlled references and media processing to a third party without any connection to update automation.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Text-to-Speech

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 86% confidence
• Finding: This TTS request exports text to an outside service for speech synthesis. In a skill advertised for updates, the unexpected transfer of possibly sensitive text is a privacy and trust issue.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Text-to-Speech

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 86% confidence
• Finding: This TTS request exports text to an outside service for speech synthesis. In a skill advertised for updates, the unexpected transfer of possibly sensitive text is a privacy and trust issue.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Speech-to-Text

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 89% confidence
• Finding: The STT call sends audio content to a third-party processor, potentially disclosing sensitive spoken information. That is far outside the legitimate context of an updater and therefore more dangerous than the same feature in a speech-focused skill.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Speech-to-Text

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 89% confidence
• Finding: The STT call sends audio content to a third-party processor, potentially disclosing sensitive spoken information. That is far outside the legitimate context of an updater and therefore more dangerous than the same feature in a speech-focused skill.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Music Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 84% confidence
• Finding: Music generation transmits prompts to an external service and introduces unrelated creative-output functionality. In this context, the issue is not the API call alone but the unjustified capability hidden inside a differently described skill.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Background Removal

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 80% confidence
• Finding: This background-removal request sends image input to a third-party service with no relation to automatic updating. The misleading skill context increases the concern because operators may not review it as a media-processing tool.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Background Removal

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 80% confidence
• Finding: This background-removal request sends image input to a third-party service with no relation to automatic updating. The misleading skill context increases the concern because operators may not review it as a media-processing tool.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Document Processing

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 88% confidence
• Finding: Document processing sends a document URL to a third-party parser, which may expose sensitive files or references. In an updater skill, such document exfiltration risk is unexpected and therefore more severe from a trust perspective.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Web Search

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 88% confidence
• Finding: The web-search request forwards user queries to a third-party service, potentially revealing sensitive interests or operational context. This is unrelated to updating and broadens the external data-sharing surface.

Static analysis

No suspicious patterns detected.