ClawHub
Back to skill

Security audit

Manage Ambush Streams

Security checks for vulnerabilities and agentic risk

Overview

The skill’s access and ongoing news delivery match its stated purpose, with clear limits and confirmation for permanent deletion.

Connecting grants access to your Ambush streams and enables ongoing delivery to configured destinations. Check the destination before routing and avoid sensitive details in monitoring prompts. Pausing or muting stops future activity; muting cancels pending deliveries, and stream deletion is permanent. This review does not audit the remote service or referenced plugin implementation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
## Setup

1. Create an Ambush account at https://app.ambush.ai/sign-up.
2. Connect the Ambush Streams MCP server at `https://api.ambush.ai/mcp`. It uses OAuth, so the user signs in through the browser; there is no API key to copy.
   - OpenClaw: `openclaw plugins install clawhub:@ambush-ai/ambush-streams` installs this skill and the MCP connection together.
   - Other hosts: add `https://api.ambush.ai/mcp` as a remote Streamable HTTP MCP server with OAuth.
3. Destinations (Slack, webhook, iMessage, Telegram) are set up in the Ambush app at https://app.ambush.ai; this skill routes streams to them.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
1. Create an Ambush account at https://app.ambush.ai/sign-up.
2. Connect the Ambush Streams MCP server at `https://api.ambush.ai/mcp`. It uses OAuth, so the user signs in through the browser; there is no API key to copy.
   - OpenClaw: `openclaw plugins install clawhub:@ambush-ai/ambush-streams` installs this skill and the MCP connection together.
   - Other hosts: add `https://api.ambush.ai/mcp` as a remote Streamable HTTP MCP server with OAuth.
3. Destinations (Slack, webhook, iMessage, Telegram) are set up in the Ambush app at https://app.ambush.ai; this skill routes streams to them.

## Operating rules

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
- Resolve a stream by its returned ID. When names are duplicated or the target is ambiguous, present the matching names, prompts, and IDs and ask the user to choose.
- Never invent a stream ID, cursor, prompt, status, emission, or tool result.
- Treat a missing stream name gracefully: identify it by a short prompt excerpt and its ID.
- If authentication is required, ask the user to connect or reauthenticate Ambush Streams. Never ask the user to paste a bearer token.
- Report the result of every mutation, including the stream ID and returned status. Do not repeat a non-idempotent create call after an uncertain failure.

## Create a stream

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · agents/openai.yaml (reported line 11)May include surrounding context.

yaml
value: "ambush-streams"
      description: "Ambush Streams MCP server"
      transport: "streamable_http"
      url: "https://api.ambush.ai/mcp"
policy:
  allow_implicit_invocation: true

Static analysis

No suspicious patterns detected.