ClawHub
Back to skill

Security audit

HARPA AI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent HARPA Grid integration, but it can send authenticated browser page content and AI outputs to external services without strong privacy boundaries.

Install only if you intend to let HARPA Grid automate a browser session that may already be logged in to websites. Use it on public or low-sensitivity pages by default, prefer targeted grab selectors over full-page {{page}} prompts, avoid private/internal/account pages unless you explicitly approve the data transfer, and send webhooks only to endpoints you control and trust.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill explicitly promotes scraping behind-login pages from a real browser session using the user's cookies/auth state, and elsewhere supports sending full page content to HARPA for prompts via `{{page}}`. That creates a clear risk of exfiltrating sensitive authenticated content, session-derived private data, or internal pages to a third-party API without strong in-file warnings, consent boundaries, or data minimization guidance.

External Transmission

Medium
Category
Data Exfiltration
Content
## API Reference

**Endpoint:** `POST https://api.harpa.ai/api/v1/grid`
**Auth:** `Authorization: Bearer $HARPA_API_KEY`
**Content-Type:** `application/json`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## API Reference

**Endpoint:** `POST https://api.harpa.ai/api/v1/grid`
**Auth:** `Authorization: Bearer $HARPA_API_KEY`
**Content-Type:** `application/json`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## API Reference

**Endpoint:** `POST https://api.harpa.ai/api/v1/grid`
**Auth:** `Authorization: Bearer $HARPA_API_KEY`
**Content-Type:** `application/json`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## API Reference

**Endpoint:** `POST https://api.harpa.ai/api/v1/grid`
**Auth:** `Authorization: Bearer $HARPA_API_KEY`
**Content-Type:** `application/json`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**Full page scrape:**

```bash
curl -s -X POST https://api.harpa.ai/api/v1/grid \
  -H "Authorization: Bearer $HARPA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Perform a web search. Supports operators like `site:`, `intitle:`.

```bash
curl -s -X POST https://api.harpa.ai/api/v1/grid \
  -H "Authorization: Bearer $HARPA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Execute one of 100+ built-in HARPA commands or a custom automation on a target page.

```bash
curl -s -X POST https://api.harpa.ai/api/v1/grid \
  -H "Authorization: Bearer $HARPA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
71% confidence
Finding
The command example allows sending page-linked automation tasks and AI processing through HARPA and selectable model connections, which may forward page-derived content or extracted results to third-party AI services. Without an explicit warning about what data may leave the browser context, users may unknowingly submit sensitive website content to remote model providers.

External Transmission

Medium
Category
Data Exfiltration
Content
Send a custom AI prompt with page context. Use `{{page}}` to inject the page content.

```bash
curl -s -X POST https://api.harpa.ai/api/v1/grid \
  -H "Authorization: Bearer $HARPA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
95% confidence
Finding
The prompt example explicitly injects `{{page}}`, meaning full page contents are sent as part of a remote AI prompt. In the context of a browser automation tool that can operate on authenticated sessions, this materially increases the risk of exfiltrating confidential, personal, or internal data to external AI services.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The webhook feature documents posting results to arbitrary third-party endpoints and notes retention for 30 days, but does not clearly warn that scraped page data or AI-generated outputs may contain sensitive information. This can lead users to forward confidential browser-derived content to external systems and leave it stored asynchronously for an extended period.

Static analysis

No suspicious patterns detected.