ClawHub
Back to skill

Security audit

Gemini

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward guide for sending prompts to SkillBoss's external LLM API, with no hidden local execution or persistence found.

Install only if you are comfortable sending prompts and any included text to SkillBoss's API. Do not submit secrets, credentials, regulated data, or confidential documents unless your organization has approved SkillBoss and its data handling terms. Review the external setup guide before following it because it is outside the inspected package.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

External Transmission

Medium
Category
Data Exfiltration
Content
---
name: gemini
description: LLM one-shot Q&A, summaries, and generation via SkillBoss API Hub.
homepage: https://api.SkillBoss.co/v1/pilot
metadata: {"clawdbot":{"emoji":"♊️","requires":{"env":["SkillBoss_API_KEY"]}}}
---
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly instructs users to send prompts and text content to a third-party API, but it does not clearly warn that any supplied data will leave the local environment and be processed by an external service. This creates a real data-exposure risk if users paste secrets, internal documents, or regulated data into the example workflows.

External Transmission

Medium
Category
Data Exfiltration
Content
SkillBoss_API_KEY = os.environ["SkillBoss_API_KEY"]

def ask(prompt: str, prefer: str = "balanced") -> str:
    r = requests.post(
        "https://api.SkillBoss.co/v1/pilot",
        headers={"Authorization": f"Bearer {SkillBoss_API_KEY}", "Content-Type": "application/json"},
        json={"type": "chat", "inputs": {"messages": [{"role": "user", "content": prompt}]}, "prefer": prefer},
Confidence
89% confidence
Finding
The same code path shows outbound transmission of prompt contents to a remote LLM broker service, which is the core security concern flagged here. The risk is not code execution but confidentiality loss through third-party processing of user-supplied content.

External Transmission

Medium
Category
Data Exfiltration
Content
SkillBoss_API_KEY = os.environ["SkillBoss_API_KEY"]

def ask(prompt: str, prefer: str = "balanced") -> str:
    r = requests.post(
        "https://api.SkillBoss.co/v1/pilot",
        headers={"Authorization": f"Bearer {SkillBoss_API_KEY}", "Content-Type": "application/json"},
        json={"type": "chat", "inputs": {"messages": [{"role": "user", "content": prompt}]}, "prefer": prefer},
Confidence
89% confidence
Finding
The same code path shows outbound transmission of prompt contents to a remote LLM broker service, which is the core security concern flagged here. The risk is not code execution but confidentiality loss through third-party processing of user-supplied content.

External Transmission

Medium
Category
Data Exfiltration
Content
def ask(prompt: str, prefer: str = "balanced") -> str:
    r = requests.post(
        "https://api.SkillBoss.co/v1/pilot",
        headers={"Authorization": f"Bearer {SkillBoss_API_KEY}", "Content-Type": "application/json"},
        json={"type": "chat", "inputs": {"messages": [{"role": "user", "content": prompt}]}, "prefer": prefer},
        timeout=60,
Confidence
88% confidence
Finding
This line identifies the specific external endpoint receiving prompt data, reinforcing that user content is sent to a third-party service for inference. In this skill's context, that behavior is expected, but it remains security-relevant because users may misunderstand where their data goes.

External Transmission

Medium
Category
Data Exfiltration
Content
Quick start (curl)
```bash
curl -s https://api.SkillBoss.co/v1/pilot \
  -H "Authorization: Bearer $SkillBoss_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type":"chat","inputs":{"messages":[{"role":"user","content":"Summarize this text..."}]},"prefer":"balanced"}'
Confidence
90% confidence
Finding
This finding captures the explicit remote endpoint in the curl example, which confirms outbound transfer of user-supplied content to an external provider. The danger is contextual confidentiality exposure rather than hidden malicious behavior.

External Transmission

Medium
Category
Data Exfiltration
Content
Quick start (curl)
```bash
curl -s https://api.SkillBoss.co/v1/pilot \
  -H "Authorization: Bearer $SkillBoss_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type":"chat","inputs":{"messages":[{"role":"user","content":"Summarize this text..."}]},"prefer":"balanced"}'
Confidence
90% confidence
Finding
This finding captures the explicit remote endpoint in the curl example, which confirms outbound transfer of user-supplied content to an external provider. The danger is contextual confidentiality exposure rather than hidden malicious behavior.

Static analysis

No suspicious patterns detected.