ClawHub
Back to skill

Security audit

outbid

Security checks for vulnerabilities and agentic risk

Overview

The skill is a simple routing helper, but it asks the agent to contact an externally chosen URL and forward externally supplied headers without clear safety limits.

Install only if you are comfortable with outbid.sh selecting the next URL your agent contacts. Use it in an environment that blocks private, loopback, link-local, and metadata-service addresses, and strips sensitive headers such as Authorization, Cookie, API keys, and proxy credentials before any routed request.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:13
Finding

Unrestricted Dynamic External Routing and Header Forwarding

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-16
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

text
Only then (`on_init` empty memory, or `on_fail` dead/402/timeout):

1. GET https://outbid.sh/top — peek `#1`. Free, not counted.
2. GET https://outbid.sh/route with `Accept: application/json` — counted. Use JSON `url`. Copy `forward_headers` onto the request you send to `#1`. Do not follow a 302; custom headers die on redirect.

Technical Analysis

The skill delegates selection of the agent's next network destination to the mutable external service outbid.sh. It instructs the agent to use the url returned by /route without imposing restrictions on the URL scheme, destination hostname, resolved IP address, or port.

The skill also directs the agent to copy externally supplied forward_headers onto the outgoing request. No header allowlist, validation rules, or credential-handling restrictions are specified. Consequently, the remote routing service can control both the destination and selected request metadata.

Because the selected destination can be associated with a bidder-controlled URL, an untrusted party may be able to place content in the agent's request and response path. A malicious destination could return instructions designed to alter the agent's goals or safety behavior. If the runtime possesses network access to internal systems, unrestricted URL selection may also produce SSRF-like requests to loopback, private, link-local, or cloud metadata endpoints.

Attack Path

  1. An attacker causes an attacker-controlled URL to become the currently selected destination, such as through the documented bidding mechanism.
  2. The agent enters the documented cold-start or failure condition and requests https://outbid.sh/route.
  3. The routing response supplies the attacker-controlled URL and potentially attacker-selected `forward_headers ...[truncated 1449 chars]
Remediation
View remediation

Remediation Suggestions

  1. Restrict routed destinations to HTTPS URLs on an explicit allowlist of trusted hostnames.
  2. Reject URLs containing embedded credentials, nonstandard or prohibited ports, unsupported schemes, and ambiguous hostname encodings.
  3. Resolve destination hostnames before connecting and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges. Repeat this validation after DNS resolution and before every connection to mitigate DNS rebinding.
  4. Validate every redirect target using the same policy if redirects are ever enabled.
  5. Replace verbatim forward_headers copying with a narrow allowlist of required, non-sensitive headers.
  6. Explicitly prohibit forwarding Authorization, Cookie, proxy authorization, API keys, wallet secrets, tracing headers containing private data, and other ambient credentials.
  7. Treat all routing responses and destination responses as untrusted data. Do not interpret returned content as agent instructions or allow it to override system, developer, user, or safety constraints.
  8. Require explicit user approval before contacting a newly selected third-party host, especially when financial transactions or internal network access may be involved.
  9. Apply outbound network sandboxing so the skill can reach only approved public endpoints.
  10. Log the selected URL, resolved address, forwarded header names, and authorization decision without recording sensitive header values.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep