ClawHub
Back to skill

Security audit

NexDoc API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed NexDoc API helper that sends user-selected design content and files to NexDoc, with public publishing limited to explicit user requests.

Install only if you are comfortable sending the design text, instructions, and selected files to NexDoc. Keep NXD_API_KEY private, avoid uploading secrets or regulated data unless your policies allow it, and only ask to publish when the design is intended to be public.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This skill instructs the agent to send user-provided content and files to an external third-party API, which is a real data exfiltration boundary. Although this is the intended function of the skill, the danger is that sensitive prompts, documents, images, or business data may be transmitted off-platform without strong gating, minimization, or explicit per-request consent.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

bash
# 1) Job
JOB=$(curl -sS -X POST "$API/v1/jobs" -H "$AUTH" -H "Content-Type: application/json" \
  -d '{"name":"Loop pitch deck"}' | jq -r .job_id)

# 2) Run — multipart when you have files (content.md, logos, photos, PDFs)

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The JSON run creation call sends inline content and instructions directly to the external NexDoc service. Because the skill encourages sending substantive user content for generation, this creates a genuine risk of exposing confidential text, proprietary plans, or personal data to an external processor.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

-F "files=@./logo.png;type=image/png;filename=logo.png" | jq -r .run_id)

2b) JSON when everything is inline

curl -sS -X POST "$API/v1/jobs/$JOB/runs" -H "$AUTH" -H "Content-Type: application/json"
-d '{"format":"landing-page","instructions":"Dark editorial. Hero + 3 features + pricing + FAQ.","content":"# Acme\n\nAPI-first design for product teams.\n\n- Fast\n- Brand-aware\n- Export to PDF/HTML"}'

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

  1. Download when a file is wanted:
bash
curl -sS -X POST "$API/v1/jobs/$JOB/export" -H "$AUTH" -H "Content-Type: application/json" \
  -d "{\"format\":\"pdf\",\"run_id\":\"$RUN_ID\"}" | jq -r .download_url     # or "html" / "png" → ZIP

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The publish endpoint makes generated content publicly accessible via a public URL, creating a meaningful confidentiality risk if invoked on sensitive designs. Even though the skill says to publish only on explicit request, accidental or ambiguous triggering could expose private business, personal, or regulated information to the internet.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

  1. Publish only on explicit request (“publish”, “make it public”, “live link”):
bash
curl -sS -X POST "$API/v1/jobs/$JOB/publish" -H "$AUTH" -H "Content-Type: application/json" \
  -d "{\"run_id\":\"$RUN_ID\"}" | jq -r .public_url          # undo: POST …/unpublish

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The update call sends revised instructions and potentially content to the external API, continuing the same third-party disclosure risk as initial creation. Repeated edits can also leak additional sensitive context over time if agents automatically iterate without renewed user awareness.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

Update (same job)

bash
curl -sS -X POST "$API/v1/jobs/$JOB/runs" -H "$AUTH" -H "Content-Type: application/json" \
  -d '{"format":"pitch-deck","instructions":"Tighten slide 3 to three bullets; make the closing CTA green. Keep everything else.","content":""}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference.md (reported line 78)May include surrounding context.

Presigned flow (use when bytes live on a server, when reusing one asset across many runs, or when the multipart body would be large):

bash
UP=$(curl -sS -X POST "$API/v1/files/request-upload" -H "$AUTH" -H "Content-Type: application/json" \
  -d "{\"filename\":\"logo.png\",\"content_type\":\"image/png\",\"size_bytes\":$(wc -c < logo.png | tr -d ' ')}")
FILE_ID=$(echo "$UP" | jq -r .file_id)
curl -sS -X PUT "$(echo "$UP" | jq -r .upload_url)" -H "Content-Type: image/png" --data-binary @logo.png

Static analysis

No suspicious patterns detected.