ClawHub
Back to skill

Security audit

Clawhub Renderkit Skill

Security checks for vulnerabilities and agentic risk

Overview

RenderKit is a straightforward hosted API helper; users should understand that page content, form definitions, and responses go to RenderKit.

Install this only if you are comfortable sending the content you render, form prompts and fields, and respondent submissions to RenderKit. Avoid using it for secrets, regulated personal data, or sensitive respondent data unless you have reviewed RenderKit's privacy, retention, and compliance terms. Be careful with the close-form DELETE example because the artifact does not state whether that action is reversible.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The skill is explicitly designed to send user-provided content and collected form data to an external hosted API using curl and an API key. In context this is expected functionality, but it remains security-relevant because users may transmit sensitive structured data or respondent information to a third party without appreciating the trust boundary, making the context more dangerous for forms and hosted content than for a purely local rendering tool.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
env:
        - RENDERKIT_API_KEY
      bins:
        - curl
    primaryEnv: RENDERKIT_API_KEY
    homepage: https://renderkit.live
---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill encourages users to create hosted forms and collect respondent data through an external service without clearly warning that submitted data will leave the local environment and be stored or processed by RenderKit. This can lead to unintended disclosure of personal or sensitive information, especially when users treat the skill like a local formatting tool rather than a third-party data processor.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown includes a DELETE request to close a form, which is a potentially irreversible operation affecting availability of data collection. There is no nearby warning or note explaining the impact of this action or advising caution before use.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The comment at L130 says 'Check for new form submissions', which implies fetching submission data. Earlier in the file, the documented way to get submissions is GET /v1/forms/{form_id}/responses at L92-L97, but the example instead calls /v1/forms/{form_id}/status at L131. This is an intent-documentation mismatch within the skill documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.