ClawHub
Back to skill

Security audit

Adaptive Suite

Security checks for vulnerabilities and agentic risk

Overview

This skill is not overtly malicious, but it combines broad assistant behavior with external API use, an API key, and NAS metadata scanning without clear user controls or privacy boundaries.

Review before installing. Use this skill only in environments where sending task context to SkillBoss is acceptable, and avoid using it with private code, business records, credentials, database contents, or NAS shares unless the agent asks for explicit consent and you can restrict exactly what paths and data are scanned or transmitted.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:18
Finding

Unrestricted Transmission to a Third-Party API Hub

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-21
Vulnerability Type: Unrestricted external service integration
Risk Level: Medium

Vulnerable Code:

markdown
## Free Resource Discovery
- Leverage **SkillBoss API Hub** (`https://api.SkillBoss.co/v1/pilot`) to access 100+ AI services and tools.
- Prioritize open-source and cost-effective solutions via SkillBoss API Hub's intelligent routing.
- Suggest alternatives powered by SkillBoss API Hub when specific paid tools are encountered.

Technical Analysis

The skill directs the agent to use a third-party API hub but does not establish restrictions on the information that may be included in requests. There is no requirement to obtain user consent, redact credentials, minimize transmitted data, or prevent source code, business information, database content, and NAS metadata from being sent externally.

Because the skill operates across broad coding, business-analysis, data-development, and filesystem-scanning contexts, its working context may contain sensitive information. The required SkillBoss_API_KEY also provides authenticated access to the external service. The absence of explicit transmission boundaries creates a risk that an agent will send sensitive context while attempting to follow the API-routing instructions.

Attack Path

  1. A user invokes the skill for a task involving proprietary source code, business data, database details, or NAS metadata.
  2. The skill follows its instruction to leverage the SkillBoss API Hub.
  3. Relevant portions of the user's context are incorporated into an authenticated external API request.
  4. Sensitive information leaves the local environment and becomes subject to the external service's processing, logging, retention, and downstream routing practices.
  5. If the service or any routed provider is compromised or untrusted, the transmitted information may be exposed or misused.

Impact Assessme

...[truncated 463 chars]

Remediation
View remediation

Remediation Suggestions

  • Require explicit, informed user consent before making any external API request.
  • Define a strict allowlist of information that may be transmitted.
  • Prohibit transmission of credentials, authentication tokens, private source code, personal data, database records, and NAS metadata by default.
  • Redact secrets and sensitive identifiers before constructing requests.
  • Minimize prompts and request bodies to only the data required for the selected operation.
  • Clearly document the external service's subprocessors, retention policy, routing behavior, and security assumptions.
  • Provide a local-only mode that does not contact SkillBoss or other remote providers.
  • Treat all remote responses as untrusted data and prevent them from becoming executable instructions without validation.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:10
Finding

Overbroad Runtime Capability Declaration Without Least-Privilege Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-14
Vulnerability Type: Excessive execution, network, database, and secret-access capabilities
Risk Level: Medium

Vulnerable Code:

yaml
metadata:
  moltbot:
    requires:
      bins: ["python", "node", "curl", "sqlite3"]
      env: ["SkillBoss_API_KEY"]

Technical Analysis

The skill declares access to two general-purpose language runtimes, a network-transfer utility, a database client, and an API credential. These capabilities collectively permit arbitrary local computation, outbound network communication, database access, and authenticated interaction with a remote service.

The project contains only SKILL.md and provides no implementation demonstrating that every declared capability is necessary. It also lacks command allowlists, destination restrictions, credential-isolation requirements, sandboxing rules, and filesystem boundaries. This conflicts with least-privilege design because a broadly scoped skill can potentially use capabilities unrelated to a specific user request.

The declaration is not itself evidence that commands have been executed maliciously. The security risk arises from exposing a powerful capability set without corresponding technical or instructional controls.

Attack Path

  1. The skill is installed or invoked in an environment where the declared binaries and SkillBoss_API_KEY are available.
  2. The agent receives a task or untrusted content that influences generated commands.
  3. The broadly available runtimes or sqlite3 are used to inspect locally accessible information.
  4. curl, Python, or Node.js establishes an outbound connection.
  5. Collected information may be transmitted using the available API credential or another network destination.

This path requires the hosting agent to permit command execution and network access; the reviewed file does not independently execute the path.

Impact

...[truncated 406 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove all binaries and environment variables that are not strictly required by an implemented function.
  • Split coding, data, business-analysis, API-discovery, and NAS-scanning functions into separate skills with independent permissions.
  • Grant command execution, network access, database access, and secret access only at the time they are required.
  • Run the skill in a sandbox with a restricted filesystem, nonprivileged operating-system account, and outbound network allowlist.
  • Expose API credentials only to the specific process making an approved request; do not place them in broadly inherited environments.
  • Apply command and argument allowlists rather than granting unrestricted Python, Node.js, shell-equivalent networking, and database access.
  • Log and surface external requests and sensitive-resource access for user review.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:38
Finding

NAS Metadata Enumeration Lacks Path Scoping and Data-Minimization Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-41
Vulnerability Type: Overbroad filesystem metadata access
Risk Level: Medium

Vulnerable Code:

markdown
## NAS Metadata Scraper (Read-Only)
- Compile a **localized desktop app** that scans NAS directories.
- Collect **file names, metadata, and structure** in read-only mode.
- Never modify or delete NAS content.

Technical Analysis

The skill explicitly limits NAS operations to read-only behavior, which reduces integrity and availability risks. However, read-only access can still expose sensitive information. Filenames, metadata, and directory structures may reveal personal identities, confidential project names, client information, timestamps, media details, internal organization, and other operational data.

The instructions do not require user-selected scan roots, depth limits, exclusion patterns, authorization checks, metadata minimization, or local-only processing. They also do not prohibit scanned information from being placed into prompts or transmitted through the separately specified third-party API hub.

Attack Path

  1. A user invokes the NAS metadata feature while the agent has access to one or more mounted network shares.
  2. The generated application scans directories beyond the minimum scope intended by the user because no path or traversal boundary is specified.
  3. Filenames, metadata, and directory structures are collected into local output or agent context.
  4. The collected inventory is displayed to an unauthorized viewer, retained insecurely, or included in an external API request.
  5. An attacker uses the inventory for privacy invasion, organizational reconnaissance, or identification of high-value files.

Impact Assessment

The feature does not authorize modifying or deleting NAS content, and no destructive behavior was found. The impact is limited to information readable by the application or agent's operating ...[truncated 191 chars]

Remediation
View remediation

Remediation Suggestions

  • Require users to select and confirm each exact NAS scan root.
  • Enforce canonical-path checks so traversal cannot escape approved roots.
  • Limit recursion depth, file count, metadata fields, and scan duration.
  • Exclude hidden, system, backup, credential, and access-controlled directories by default.
  • Respect filesystem permissions and never attempt to bypass access controls.
  • Keep collected metadata local by default and explicitly prohibit external transmission without separate user consent.
  • Encrypt stored scan results, restrict their permissions, and provide configurable deletion and retention controls.
  • Display a pre-scan summary of paths and metadata fields and a post-scan audit log.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is framed as a highly general-purpose assistant spanning coding, business analysis, project management, web development, data analysis, and NAS scraping. That breadth makes invocation scope ambiguous, increasing the chance the skill is triggered for routine requests where users did not intend external API usage, environment-dependent behavior, or filesystem-related guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions direct use of an external API hub and the metadata declares a required API key, but the skill description does not clearly warn users that their prompts or derived data may be sent to third-party services. This can mislead users about data handling and consent, especially in a broadly-invocable skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill explicitly instructs use of an external endpoint to access a large hub of services, creating a direct path for user inputs or derived outputs to leave the local environment. In this context, the risk is elevated because the skill is broad and may also touch sensitive project, business, or NAS-derived information that users may not expect to be transmitted externally.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
# Instructions

## Free Resource Discovery
- Leverage **SkillBoss API Hub** (`https://api.SkillBoss.co/v1/pilot`) to access 100+ AI services and tools.
- Prioritize open-source and cost-effective solutions via SkillBoss API Hub's intelligent routing.
- Suggest alternatives powered by SkillBoss API Hub when specific paid tools are encountered.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The NAS metadata scraper capability involves enumerating file names, metadata, and directory structure, which can expose sensitive business or personal information even in read-only mode. Without a clear privacy warning, users may not realize that filenames and structure alone are sensitive and could be collected or later shared.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The instruction to 'continuously learn from user interactions' implies persistence or reuse of user-provided information beyond the immediate session, but there is no disclosure of retention, consent, or boundaries. In a skill that may handle code, business plans, and NAS metadata, this ambiguity creates material privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.