ClawHub
Back to skill

Security audit

HARPA AI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent HARPA Grid integration, but it can send authenticated browser page content and AI outputs to external services without strong privacy boundaries.

Install only if you intend to let HARPA Grid automate a browser session that may already be logged in to websites. Use it on public or low-sensitivity pages by default, prefer targeted grab selectors over full-page {{page}} prompts, avoid private/internal/account pages unless you explicitly approve the data transfer, and send webhooks only to endpoints you control and trust.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly promotes scraping behind-login pages from a real browser session using the user's cookies/auth state, and elsewhere supports sending full page content to HARPA for prompts via {{page}}. That creates a clear risk of exfiltrating sensitive authenticated content, session-derived private data, or internal pages to a third-party API without strong in-file warnings, consent boundaries, or data minimization guidance.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
## API Reference

**Endpoint:** `POST https://api.harpa.ai/api/v1/grid`
**Auth:** `Authorization: Bearer $HARPA_API_KEY`
**Content-Type:** `application/json`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
## API Reference

**Endpoint:** `POST https://api.harpa.ai/api/v1/grid`
**Auth:** `Authorization: Bearer $HARPA_API_KEY`
**Content-Type:** `application/json`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
## API Reference

**Endpoint:** `POST https://api.harpa.ai/api/v1/grid`
**Auth:** `Authorization: Bearer $HARPA_API_KEY`
**Content-Type:** `application/json`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
## API Reference

**Endpoint:** `POST https://api.harpa.ai/api/v1/grid`
**Auth:** `Authorization: Bearer $HARPA_API_KEY`
**Content-Type:** `application/json`

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Full page scrape:

bash
curl -s -X POST https://api.harpa.ai/api/v1/grid \
  -H "Authorization: Bearer $HARPA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Perform a web search. Supports operators like site:, intitle:.

bash
curl -s -X POST https://api.harpa.ai/api/v1/grid \
  -H "Authorization: Bearer $HARPA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
71% confidence
Finding

The command example allows sending page-linked automation tasks and AI processing through HARPA and selectable model connections, which may forward page-derived content or extracted results to third-party AI services. Without an explicit warning about what data may leave the browser context, users may unknowingly submit sensitive website content to remote model providers.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

Execute one of 100+ built-in HARPA commands or a custom automation on a target page.

bash
curl -s -X POST https://api.harpa.ai/api/v1/grid \
  -H "Authorization: Bearer $HARPA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The prompt example explicitly injects {{page}}, meaning full page contents are sent as part of a remote AI prompt. In the context of a browser automation tool that can operate on authenticated sessions, this materially increases the risk of exfiltrating confidential, personal, or internal data to external AI services.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

Send a custom AI prompt with page context. Use {{page}} to inject the page content.

bash
curl -s -X POST https://api.harpa.ai/api/v1/grid \
  -H "Authorization: Bearer $HARPA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The webhook feature documents posting results to arbitrary third-party endpoints and notes retention for 30 days, but does not clearly warn that scraped page data or AI-generated outputs may contain sensitive information. This can lead users to forward confidential browser-derived content to external systems and leave it stored asynchronously for an extended period.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.