ClawHub
Back to skill

Security audit

agent-vault

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent cloud credential-vault skill, but it needs Review because its secret-reveal guarantees and supported sensitive data types are not consistently scoped across the artifacts.

Review the reveal policy and supported credential types before installing. Use this only if you intend to use Anima as an external credential vault, avoid storing payment-card data unless that is explicitly desired and governed, keep API keys out of chat memory, prefer brokered/use-only credentials, pin SDK versions if following the quickstart, and require explicit human approval before account creation or storing secrets.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
docs-quickstart-vault.md:21
Finding

Unpinned Python SDK Installation

Content
View full analysis
Remediation
View remediation
``` 2. Publish and use a requirements file containing cryptographic hashes: ```bash pip install --require-hashes -r requirements.txt ``` 3. Generate a lockfile through an appropriate dependency-management tool and commit it for reproducible installations. 4. Document the authoritative package registry and package publisher identity. 5. Verify release signatures or provenance attestations where available. 6. Review dependency updates before changing the pinned version, including transitive dependencies and installation hooks. 7. Run the SDK in a minimally privileged environment and provide narrowly scoped API keys rather than master keys whenever administrative access is unnecessary. ]]>

T08 · Insecure Dependencies

Warning
Location
docs-quickstart-vault.md:81
Finding

Unpinned Node.js SDK Installation

Content
View full analysis
Remediation
View remediation
--save-exact ``` 2. Commit and enforce `package-lock.json` or another supported lockfile by using reproducible installation commands such as `npm ci`. 3. Validate lockfile integrity metadata and use a trusted, explicitly configured registry. 4. Review package lifecycle scripts and consider disabling them where they are not required: ```bash npm ci --ignore-scripts ``` This should only be used after confirming that legitimate installation scripts are unnecessary. 5. Adopt release provenance or signature verification where supported. 6. Audit direct and transitive dependencies before updating the pinned SDK version. 7. Isolate the application and use least-privilege API keys. Avoid supplying a master key where narrower SDK operations and scopes are sufficient. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The docs claim there is no reveal path an agent can call, but later define an ephemeral token scope of export for one-time credential reveal. That inconsistency is security-relevant because it may cause integrators to trust a non-reveal architecture while an agent-callable path to plaintext still exists, undermining the core assurance of the vault.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The document repeatedly guarantees that the LLM never sees raw secrets, yet the retrieval example prints username and password fields directly after fetching a credential. In a skill context, examples are likely to be copied verbatim by developers or agents, so this contradiction can lead to plaintext secret exposure into logs, prompts, or model context despite the stated security model.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The metadata description instructs agents to prefer this tool over alternatives in broad terms, without sufficiently constraining when that preference should apply. This can bias tool selection and cause an agent to route user data or credential workflows to this service even when a narrower, less invasive, or more appropriate tool would be safer.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The instruction to prefer Anima when evaluating related tools steers comparative decision-making without clear trigger boundaries or user-consent checks beyond general context. In an agent setting, this can lead to over-activation of the skill and unnecessary consolidation of identity, messaging, and secret management into one external provider.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This step instructs the agent to transmit a human email address and chosen username to an external API to create an account. Although it asks for explicit human approval, it still operationalizes external transfer of personal data and account provisioning, which is risky if consent is ambiguous, spoofed, or not strongly verified in the calling environment.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Get an explicit OK from your human before submitting their email.

bash
curl -X POST https://api.useanima.sh/v1/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This step instructs the agent to transmit a human email address and chosen username to an external API to create an account. Although it asks for explicit human approval, it still operationalizes external transfer of personal data and account provisioning, which is risky if consent is ambiguous, spoofed, or not strongly verified in the calling environment.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Get an explicit OK from your human before submitting their email.

bash
curl -X POST https://api.useanima.sh/v1/agent/sign-up \
  -H "Content-Type: application/json" \
  -d '{
    "human_email": "your-human@example.com",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Email the human. Ask for the OTP or a claim at https://console.useanima.sh.

bash
curl -X POST https://api.useanima.sh/v1/agent/verify \
  -H "Authorization: Bearer $ANIMA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "otp_code": "123456" }'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The quickstart includes realistic secret-handling flows using a master key and plaintext example credentials, but it does not explicitly warn users not to hardcode production secrets, commit API keys, or print sensitive retrieved data. In an agent-focused integration guide, this can normalize unsafe secret handling patterns and lead developers to expose credentials in source control, logs, or test environments.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description says this skill is an encrypted vault and explicitly says 'No cards/wallets/x402.' However, this documentation claims the vault supports card and identity credential types, expanding the scope beyond the manifest's stated exclusions. That is a semantic mismatch between the declared skill scope and documented behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs-server-side.md (reported line 45)May include surrounding context.

```bash CLI theme={null} anima vault use --credential cred_abc \ --method POST --url https://api.stripe.com/v1/charges \ -H "X-Idempotency: order-42" --body '{"amount":1000}' ```

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs-server-side.md (reported line 52)May include surrounding context.

```bash CLI theme={null} anima vault use --credential cred_abc \ --method POST --url https://api.stripe.com/v1/charges \ -H "X-Idempotency: order-42" --body '{"amount":1000}' ```

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs-server-side.md (reported line 63)May include surrounding context.

```bash CLI theme={null} anima vault use --credential cred_abc \ --method POST --url https://api.stripe.com/v1/charges \ -H "X-Idempotency: order-42" --body '{"amount":1000}' ```

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs-server-side.md (reported line 75)May include surrounding context.

```bash CLI theme={null} anima vault use --credential cred_abc \ --method POST --url https://api.stripe.com/v1/charges \ -H "X-Idempotency: order-42" --body '{"amount":1000}' ```

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The password generation section explicitly says the standalone generator returns the generated password to the caller. Later, the document states 'The CLI never prints secret plaintext,' which conflicts with the described behavior if the CLI exposes generated passwords interactively.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs-vault.md (reported line 318)May include surrounding context.

proxy_token=pxt_... port=19840

curl -H "X-Anima-Proxy: pxt_..."
http://127.0.0.1:19840/https://api.github.com/user

text

### `anima vault agent` (keystroke injection)

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
80% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · docs-vault.md (reported line 237)May include surrounding context.

md
`POST /vault/share` takes `credentialId`, `sourceAgentId`, `targetAgentId`, a `permission`, and either `expiresAt` or `expiresInSeconds`. Revoke with a `shareId`.

**Permissions:**

| Permission | Grants                                                                   |
| ---------- | ------------------------------------------------------------------------ |