ClawHub
Back to skill

Security audit

Aevris

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent security-scanning purpose, but it broadly sends prompts, responses, documents, tool metadata, and action details to an external service and lets remote verdicts control agent behavior.

Review this carefully before installing. It may be appropriate only where users and administrators knowingly accept third-party scanning of prompts, outputs, files, tool metadata, and planned actions. Avoid enabling it for confidential, regulated, proprietary, or secret-bearing work unless there are clear contractual, retention, redaction, and scoping controls outside this artifact.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

other

Error
Location
SKILL.md:21
Finding

Mandatory Transmission of Sensitive Content to an External Service

Content
View full analysis
"}' ``` ```bash curl -X POST https://api.aevris.ai/v1/scan/output \ -H "Content-Type: application/json" \ -H "x-api-key: $AEVRIS_API_KEY" \ -d '{ "prompt": "", "response": "" }' ``` ```bash curl -X POST https://api.aevris.ai/v1/scan/document \ -H "Content-Type: application/json" \ -H "x-api-key: $AEVRIS_API_KEY" \ -d '{ "content": "", "source": "contract.pdf" }' ``` ### Technical Analysis The Skill requires complete user messages, generated responses, document text, MCP tool information, and action descriptions to be transmitted to `https://api.aevris.ai`. This crosses the local trust boundary and gives an external service access to potentially confidential information. The instructions provide no content minimization, secret redaction, sensitivity classification, user consent, retention restrictions, or local-on ...[truncated 1449 chars]
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:54
Finding

External API Verdicts Can Control Agent Requests, Outputs, and Tool Execution

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:21
Finding

Unconditional Interception Exceeds Least-Privilege Requirements

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill encourages sending prompts, responses, documents, and tool metadata to an external API but does not provide a clear user-facing warning at the point of use. That omission can lead to unconsented disclosure of sensitive data, including proprietary documents, secrets embedded in prompts, and internal agent/tool context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs agents to invoke the service on virtually every interaction: all user messages, model outputs, tool calls, MCP tools, and documents. This creates a broad data-exfiltration and availability surface because routine prompts, sensitive documents, and internal tool metadata may all be sent to a third-party API by default, even when scanning is unnecessary.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This endpoint sends raw user messages or content to an external service for scanning. In the context of a security middleware skill that recommends scanning every user message and document, this materially increases the risk of leaking sensitive prompts, personal data, credentials, or confidential business content to a third party.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Scan any user message, document, or content before it reaches the AI.

bash
curl -X POST https://api.aevris.ai/v1/scan \
  -H "Content-Type: application/json" \
  -H "x-api-key: $AEVRIS_API_KEY" \
  -d '{"prompt": "<user message or content here>"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This endpoint sends raw user messages or content to an external service for scanning. In the context of a security middleware skill that recommends scanning every user message and document, this materially increases the risk of leaking sensitive prompts, personal data, credentials, or confidential business content to a third party.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Scan any user message, document, or content before it reaches the AI.

bash
curl -X POST https://api.aevris.ai/v1/scan \
  -H "Content-Type: application/json" \
  -H "x-api-key: $AEVRIS_API_KEY" \
  -d '{"prompt": "<user message or content here>"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This endpoint transmits both the original prompt and the full model response to an external API. That can expose highly sensitive generated content, hidden system-derived information, or confidential user data that appears in the output, especially because the skill directs scanning of every response by default.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

Scan every AI-generated response before delivering it to the user. Catches successful jailbreaks and model manipulation that slipped through input filters.

bash
curl -X POST https://api.aevris.ai/v1/scan/output \
  -H "Content-Type: application/json" \
  -H "x-api-key: $AEVRIS_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This endpoint transmits both the original prompt and the full model response to an external API. That can expose highly sensitive generated content, hidden system-derived information, or confidential user data that appears in the output, especially because the skill directs scanning of every response by default.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

Scan every AI-generated response before delivering it to the user. Catches successful jailbreaks and model manipulation that slipped through input filters.

bash
curl -X POST https://api.aevris.ai/v1/scan/output \
  -H "Content-Type: application/json" \
  -H "x-api-key: $AEVRIS_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This endpoint sends descriptions of pending agent actions and blast-radius classifications to an external API. While less likely to contain full user content, action descriptions may still reveal sensitive operational intent, file paths, deployment plans, or destructive capabilities, which is risky when the skill recommends pre-execution scanning for many actions.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

Call before executing any tool that writes, deletes, sends, deploys, or modifies anything. Classifies blast radius and blocks or queues high-risk actions.

bash
curl -X POST https://api.aevris.ai/v1/scan/action \
  -H "Content-Type: application/json" \
  -H "x-api-key: $AEVRIS_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This endpoint sends MCP tool names, descriptions, and potentially actual tool responses to a third-party service. Tool schemas and responses can reveal internal capabilities, privileged workflows, credentials patterns, or proprietary system design, making this especially sensitive in agent environments.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

Scan MCP tool schemas before loading them into the agent context. Detects supply chain attacks where tool descriptions contain hidden instructions.

bash
curl -X POST https://api.aevris.ai/v1/scan/mcp \
  -H "Content-Type: application/json" \
  -H "x-api-key: $AEVRIS_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This endpoint sends MCP tool names, descriptions, and potentially actual tool responses to a third-party service. Tool schemas and responses can reveal internal capabilities, privileged workflows, credentials patterns, or proprietary system design, making this especially sensitive in agent environments.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

Scan MCP tool schemas before loading them into the agent context. Detects supply chain attacks where tool descriptions contain hidden instructions.

bash
curl -X POST https://api.aevris.ai/v1/scan/mcp \
  -H "Content-Type: application/json" \
  -H "x-api-key: $AEVRIS_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This endpoint transmits document contents to an external API before the AI reads them. Documents may contain contracts, emails, regulated personal data, trade secrets, or embedded credentials, so automatic external scanning of full content creates a significant confidentiality and compliance risk.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

Scan files and documents before the AI reads them. Detects indirect prompt injection embedded in PDFs, contracts, emails, and web pages.

bash
curl -X POST https://api.aevris.ai/v1/scan/document \
  -H "Content-Type: application/json" \
  -H "x-api-key: $AEVRIS_API_KEY" \
  -d '{

Static analysis

No suspicious patterns detected.