ClawHub
Back to skill

Security audit

autothread

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it has review-worthy gaps around credential-bearing API calls and overly broad tool access.

Review before installing. Use this only with bots/accounts whose permissions are limited to the groups or servers where /topic should work, avoid using it on sensitive messages, and ensure the runtime environment cannot set AUTOTHREAD_API_BASE to an arbitrary host. Prefer an updated version that removes the broad direct tool permissions and validates or removes API endpoint overrides.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/autothread-telegram.sh:39
Finding

Unrestricted Telegram API endpoint override can disclose bot credentials and message content

Content
View full analysis
Remediation
View remediation
` or a Unix socket. 5. Reject non-HTTPS destinations and validate the parsed hostname against an exact allowlist. 6. Do not place credentials in URLs when an API supports safer authentication mechanisms. Telegram requires its current URL token format, making strict destination validation especially important. 7. Sanitize the environment in the parent service before invoking adapters. 8. Add tests verifying that arbitrary domains, user-info URLs, redirects, and plaintext HTTP endpoints are rejected. 9. Consider using `curl --proto '=https' --max-redirs 0 --fail-with-body` for production requests. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/autothread-discord.sh:37
Finding

Unrestricted Discord API endpoint override can disclose the bot token and reposted content

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:29
Finding

Skill grants unnecessary direct access to credential files, networking, arbitrary Python, and messaging tools

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/autothread-discord.sh:99
Finding

Discord reposts user-controlled content without suppressing mentions

Content
View full analysis
" + $msg + "\n— **" + $sender + "**")}') SEND_RESULT=$(curl -s -X POST \ -H "Authorization: Bot ${BOT_TOKEN}" \ -H "Content-Type: application/json" \ -d "$PAYLOAD" \ "$API_BASE/channels/${THREAD_ID}/messages") ``` ### Technical Analysis Both `$MSG` and `$SENDER` are user-controlled or externally supplied and are inserted into a Discord message without an `allowed_mentions` policy. JSON encoding prevents JSON injection, but it does not prevent Discord from interpreting mention syntax inside the resulting content. Discord can process forms such as: ```text @everyone @here <@USER_ID> <@&ROLE_ID> ``` Blockquote formatting does not reliably neutralize Discord mentions. Consequently, content copied by the bot may generate notifications that the original sender could not otherwise generate, depending on channel settings and the bot's permissions. ### Attack Path 1. A user submits a `/topic` message containing `@everyone`, `@here`, a role mention, or a user mention. 2. The Agent passes the text to `autothread-discord.sh`. 3. The script creates a public thread from the original message. 4. It reposts the supplied content as a new bot-authored message. 5. Discord parses the mention syntax because the payload does not restrict `allowed_mentions`. 6. Members, roles, or the broader server population receive unintended notifications where the bot has sufficient permission. ### Impact Assessment The vulnerability can cause notification spam, unwanted role or user pings, disruption in high-traffic servers, and abuse of the bot's elevated mention permissions. The scope is generally limited to the Discord server and thread in w ...[truncated 168 chars]
Remediation
View remediation
" + $msg + "\n— **" + $sender + "**"), allowed_mentions: { parse: [], users: [], roles: [], replied_user: false } }') ``` Also: 1. Apply the same policy to every Discord message generated from user-controlled content. 2. Consider neutralizing markdown in sender attribution to prevent presentation manipulation. 3. Add tests covering `@everyone`, `@here`, user mentions, role mentions, and mention syntax inside blockquotes. 4. Avoid relying exclusively on Discord permission settings, because they may differ across servers and can change over time. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

md
### Discord

1. Create an application at https://discord.com/developers → **Bot** → copy the token.
2. Invite the bot to your server via **OAuth2 → URL Generator**: scope `bot`, and check `View Channel`, `Send Messages`, `Create Public Threads`, `Send Messages in Threads`, `Read Message History`. (This only registers the bot with your server — the skill itself installs no cron jobs, startup scripts, daemons, or state files; each `/topic` invocation runs once and exits.)
3. Enable **Developer Mode** in Discord (Settings → Advanced), then right-click a text channel → *Copy Channel ID*, and right-click any message in it → *Copy Message ID*.
4. Run the adapter for real:

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/autothread-discord.sh (reported line 85)May include surrounding context.

sh
# ── create the thread from the original message ─────────────────────
PAYLOAD=$(jq -n --arg name "$TITLE" '{"name": $name}')
CREATE_RESULT=$(curl -s -X POST \
  -H "Authorization: Bot ${BOT_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/autothread-discord.sh (reported line 104)May include surrounding context.

sh
# ── create the thread from the original message ─────────────────────
PAYLOAD=$(jq -n --arg name "$TITLE" '{"name": $name}')
CREATE_RESULT=$(curl -s -X POST \
  -H "Authorization: Bot ${BOT_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/autothread-telegram.sh (reported line 81)May include surrounding context.

sh
TITLE=$(printf '%s' "$TITLE" | cut -c1-128)

# ── create forum topic ──────────────────────────────────────────────
CREATE_RESULT=$(curl -s "$API/bot${BOT_TOKEN}/createForumTopic" \
  -d "chat_id=${CHAT_ID}" \
  --data-urlencode "name=${TITLE}")

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/autothread-telegram.sh (reported line 101)May include surrounding context.

sh
QUOTED="<blockquote>${ESC_MSG}</blockquote>
— <b>${ESC_SENDER}</b>"

  SEND_RESULT=$(curl -s "$API/bot${BOT_TOKEN}/sendMessage" \
    -d "chat_id=${CHAT_ID}" \
    -d "message_thread_id=${TOPIC_ID}" \
    --data-urlencode "text=${QUOTED}" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/autothread-telegram.sh (reported line 113)May include surrounding context.

sh
fi
else
  # Media — forward to preserve attachments
  FWD_RESULT=$(curl -s "$API/bot${BOT_TOKEN}/forwardMessage" \
    -d "chat_id=${CHAT_ID}" \
    -d "from_chat_id=${CHAT_ID}" \
    -d "message_id=${MESSAGE_ID}" \

Static analysis

No suspicious patterns detected.