ClawHub
Back to skill

Security audit

AgentSafe Scan

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed hosted scanner skill that sends skill URLs or content to AgentSafe and offers optional paid quota/watch features, with no hidden local execution or persistence found.

Install only if you are comfortable using a third-party hosted scanner. Treat submitted skill markdown, URLs, agent IDs, watch entries, and payment transaction hashes as data shared with AgentSafe; do not send secrets, private repository URLs with tokens, credentials, or personal data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
curl -fsSL https://agentsafe.up.railway.app/skill.md -o ./SKILL.md

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

BASE="${AGENTSAPE_BASE_URL:-https://agentsafe.up.railway.app}" AID="${AGENTSAPE_AGENT_ID:-your-agent-name}"

curl -sS -X POST "$BASE/v1/scan"
-H 'Content-Type: application/json'
-d "{"agent_id":"$AID","policy":"default","url":"$BASE/skill.md"}"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

Batch (fleet allowlist / multi-skill)

bash
curl -sS -X POST "${AGENTSAPE_BASE_URL:-https://agentsafe.up.railway.app}/v1/scan/batch" \
  -H 'Content-Type: application/json' \
  -d "{
    \"agent_id\": \"${AGENTSAPE_AGENT_ID:-YourAgentName}\",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

bash
# 1) Catalog
curl -sS https://agentsafe.up.railway.app/v1/packs

# 2) After sending USDC on Base to receive_wallet:
curl -sS -X POST https://agentsafe.up.railway.app/v1/packs/activate \

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest mentions a free quota and optional micropayment after quota exhaustion for scanning, but these lines document a separate packs catalog and entitlement activation system. That is a product capability beyond the declared purpose of invoking a hosted heuristic static scan before installs or promotions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest describes a habit gate used before remote skill install, re-fetch, or allowlist promotion, emphasizing static analysis only. These documented endpoints add ongoing watch lifecycle features (add, check, remove, due) for persistent monitoring, which is a broader product capability than a one-shot pre-decision scan.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/payment.md (reported line 29)May include surrounding context.

Watch / rescan (NEW in v0.1.8)

bash
curl -sS -X POST https://agentsafe.up.railway.app/v1/watch/add \
  -H 'Content-Type: application/json' \
  -d '{"agent_id":"YourAgent","url":"https://example.com/SKILL.md"}'

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file includes curl examples that send agent_id, url, and watch_id to an external API endpoint, which affects user data/privacy and performs network transmission. The surrounding documentation explains pricing and usage but does not warn users that these values are sent to a third-party service or that watched URLs are monitored remotely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.