ClawHub
Back to skill

Security audit

Placed

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Placed career-platform integration, but its credential-handling instructions create unnecessary local code-execution and secret-storage risk.

Install only if you are comfortable sending career materials to Placed. Treat the API key as a secret, avoid the documented source-based credential loading, store the key with restrictive permissions or a secret manager, and confirm before sending resumes, job applications, interview answers, salary expectations, or LinkedIn content.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:16
Finding

Credential File Is Executed as Shell Code

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–21
Vulnerability Type: Unsafe execution of a credential file
Risk Level: High

Vulnerable code:

bash
Load the key from `~/.config/placed/credentials`, falling back to the environment:

if [ -z "$PLACED_API_KEY" ] && [ -f "$HOME/.config/placed/credentials" ]; then
  source "$HOME/.config/placed/credentials"
fi

Technical Analysis

The source command interprets the entire credentials file as shell code. Loading an API key does not require code execution; the file should instead be treated strictly as data. If the file contains command substitutions, shell commands, function definitions, or other shell syntax, those instructions execute with the permissions of the agent process.

This behavior exceeds the minimum privileges required by the Skill. Its declared functionality only requires reading a Placed API key and sending authorized HTTPS requests. It does not require executing arbitrary instructions stored under the configuration directory.

Attack Path

  1. An attacker or compromised local process obtains the ability to create or modify ~/.config/placed/credentials.
  2. The attacker inserts content such as:
    bash
    export PLACED_API_KEY=placeholder
malicious_command
  3. The Skill is invoked in a session where PLACED_API_KEY is unset.
  4. The documented initialization logic finds the credentials file and executes it with source.
  5. The attacker-supplied command runs under the account and privileges of the agent.

This path requires the attacker to influence the credentials file, such as through another compromised component, unsafe setup flow, overly broad file permissions, or manipulation of the credential value before it is persisted.

Impact Assessment

Successful exploitation permits arbitrary command execution with the agent user's privileges. Depending on that account's access, an att ...[truncated 323 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not use source, ., eval, or a shell interpreter to load credential data.
  • Store the file as a raw key or use a strictly parsed configuration format.
  • Read a raw-key file without executing its contents, for example:
    bash
    credential_file="$HOME/.config/placed/credentials"
if [ -z "${PLACED_API_KEY:-}" ] && [ -f "$credential_file" ]; then
  IFS= read -r PLACED_API_KEY < "$credential_file"
  export PLACED_API_KEY
fi
  • Validate the value according to the documented Placed API-key format before use.
  • Reject newline characters and unexpected control characters.
  • Verify that the credential file is a regular file, is owned by the expected user, and is not writable by group or other users.
  • Prefer an operating-system credential manager or secret store where available.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:27
Finding

Unsafe API-Key Interpolation Enables Shell Injection and Insecure Secret Storage

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–29
Vulnerability Type: Shell command injection and insufficient credential-file protection
Risk Level: High

Vulnerable code:

bash
mkdir -p "$HOME/.config/placed"
echo "export PLACED_API_KEY=<key_provided_by_user>" > "$HOME/.config/placed/credentials"
export PLACED_API_KEY=<key_provided_by_user>

Technical Analysis

The instructions place a user-provided API key directly into shell command syntax. They do not define a safe parameter-passing mechanism or require shell-safe quoting. If an agent substitutes attacker-controlled text for the placeholder, shell metacharacters or command substitutions in that text can be interpreted by the shell. Command substitution can execute even when embedded inside the double-quoted echo argument.

The API key is also stored as plaintext without explicitly setting restrictive permissions. The resulting permissions depend on the process umask. On a permissively configured system, another local user or process may be able to read the bearer credential. The stored content is executable shell syntax, compounding this issue with the separate unsafe source behavior.

Attack Path

  1. The Skill asks a user or an untrusted surrounding context to provide a Placed API key.
  2. An attacker supplies a value containing shell syntax, such as a command substitution, instead of a normal key.
  3. The agent replaces the placeholder directly with that value and runs the documented commands.
  4. The shell evaluates the injected syntax while processing echo or export.
  5. The injected command executes with the agent user's privileges.
  6. Separately, if the credentials file is created with overly broad permissions, another local principal can retrieve the plaintext bearer key and use the Placed API as the victim.

Exploitation depends on the documented placeholder being replaced by untrusted text directl ...[truncated 904 chars]

Remediation
View remediation

Remediation Suggestions

  • Never substitute user-controlled credential text directly into generated shell commands.
  • Collect the secret through a protected secret-input mechanism and pass it as data rather than executable syntax.
  • Store only the raw key, not an export statement.
  • Create the directory and file with explicit restrictive permissions:
    bash
    umask 077
install -d -m 700 "$HOME/.config/placed"
printf '%s\n' "$PLACED_API_KEY" > "$HOME/.config/placed/credentials"
chmod 600 "$HOME/.config/placed/credentials"
  • Ensure PLACED_API_KEY is populated through a mechanism that does not reevaluate its contents as shell code.
  • Validate the key format, impose a reasonable length limit, and reject newlines, NUL bytes, and control characters.
  • Avoid logging, displaying, or placing the key in command-line arguments where process listings or shell history might expose it.
  • Prefer a platform credential manager or scoped secret store and support key rotation if exposure is suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill promotes resume, interview, job-tracker, salary, and LinkedIn-related features but does not clearly disclose that user career data will be transmitted to the Placed API. Because this data can include resumes, job history, salary expectations, and application details, the missing privacy notice creates a meaningful risk of uninformed disclosure to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs storing the API key in ~/.config/placed/credentials as plaintext and exporting it into the shell environment without any warning about secret sensitivity or file permissions. This increases the chance of credential theft via local compromise, backups, other processes, or accidental disclosure, especially because the key grants access to a third-party career platform handling potentially sensitive user data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The documented workflow sends data and the bearer token to an external API endpoint, which is expected for this integration but still represents real external transmission risk. In this skill's context, the data being sent is especially sensitive career information, so the lack of explicit minimization, consent, and privacy guidance makes the transmission more dangerous than a generic low-sensitivity API call.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Every Placed action is a POST to the same endpoint:

bash
curl -s -X POST https://placed.exidian.tech/api/mcp \
  -H "Authorization: Bearer $PLACED_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"<tool_name>","arguments":{<args>}}}'

Static analysis

No suspicious patterns detected.