ClawHub
Back to skill

Security audit

Sendbl

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent file-transfer purpose, but its raw shell examples can expose bearer tokens and may be unsafe if user text is inserted literally.

Review before installing. Use this skill only for files you intend to send through Sendbl, protect SENDBL_API_KEY and owner_token values like passwords, avoid pasting real owner tokens into shared logs or transcripts, and prefer a safer client or manually JSON-encoded commands rather than literal placeholder substitution in shell examples.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:93
Finding

Owner Tokens Exposed Through URL Query Parameters

Content
View full analysis
&limit=50" ``` Returns the array of files with `file_id` and `filename`. To get a download URL for one of them: ```sh curl -sS "https://api.sendbl.com/v1/fileDownloadLink?token=&file_id=" ``` ### 5. Delete a link Requires the `owner_token`. Removes the link **and all uploaded files**. ```sh curl -sS -X DELETE "https://api.sendbl.com/v1/uploadLink?token=" ``` ``` ### Technical Analysis The documented API commands place the capability-bearing `owner_token` directly in URL query parameters. Query strings are commonly retained in: - Shell command history - Process command-line information - HTTP proxy and gateway access logs - Server request logs - Monitoring and telemetry platforms - Terminal transcripts and diagnostic output HTTPS protects the URL while it is in transit, but it does not prevent disclosure through these local or server-side recording mechanisms. According to the documented behavior, possession of an owner token is sufficient to list uploaded files, generate file download links, and delete the associated link and all its files. The token therefore functions as a sensitive bearer credential. ### Attack Path 1. A user or agent executes one of the documented commands with a real owner token. 2. The full command or requested URL is retained in shell history, process telemetry, proxy logs, server access logs, or monitoring data. 3. An attacker with access to one of those records extracts the `owner_token`. 4. The attacker submits the token to the unauthenticated owner-token endpoints. 5. The attacker lists file metadata, obtains download links for uploaded files, or ...[truncated 576 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:47
Finding

Command Injection Risk from Direct Substitution into Shell Templates

Content
View full analysis
", "message": "" }' ``` ```sh curl -sS -X POST "https://api.sendbl.com/v1/sendFile" \ -H "x-api-key: $SENDBL_API_KEY" \ -H "content-type: application/json" \ -d '{ "recipient_name": "", "filename": "", "purpose": "", "message": "" }' ``` ### Technical Analysis The skill instructs an agent to construct shell commands by replacing placeholders with values that may originate from user input. The JSON request bodies are enclosed in shell single quotes, but the instructions do not require JSON serialization or shell-safe argument construction. If a user-controlled purpose, message, recipient, or filename contains a single quote, it can terminate the shell-quoted JSON argument. Subsequent shell metacharacters can then be interpreted as commands. For example, a malicious value following the pattern below could escape the quoted request body when inserted literally: ```text '; ; # ``` Even when no command injection occurs, unescaped quotation marks, backslashes, control characters, or newlines can produce malformed JSON or alter the meaning of the request. The vulnerability arises because shell quoting and JSON encoding are separate security boundaries, while the templates handle neither boundary safely for arbitrary input. The project contains documentation rather than an executable implementation, so exploitation depends on an agent or user performing direct textual substitution as instructed. Nevertheless, t ...[truncated 1359 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

Setup (one-time)

  1. Sign in at https://sendbl.com/account with Google.

  2. Open https://sendbl.com/account/tokens and create a personal access token. Treat this token as a password: store it only in your environment, revoke it from the same page if it is ever exposed, and rotate it periodically.

  3. Set the env var:

    sh

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

Setup (one-time)

  1. Sign in at https://sendbl.com/account with Google.

  2. Open https://sendbl.com/account/tokens and create a personal access token. Treat this token as a password: store it only in your environment, revoke it from the same page if it is ever exposed, and rotate it periodically.

  3. Set the env var:

    sh

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md
# sendbl OpenClaw skill

OpenClaw skill for [Sendbl](https://sendbl.com), a file-exchange API for LLM agents. Lets your OpenClaw assistant create file-request links, send files, check link status, list uploaded files, and delete links.

## Install

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

All endpoints below are relative to:

text
https://api.sendbl.com/v1

All API key calls send the key as the x-api-key header.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

All endpoints below are relative to:

text
https://api.sendbl.com/v1

All API key calls send the key as the x-api-key header.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

All endpoints below are relative to:

text
https://api.sendbl.com/v1

All API key calls send the key as the x-api-key header.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

All endpoints below are relative to:

text
https://api.sendbl.com/v1

All API key calls send the key as the x-api-key header.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

When the user wants someone else to upload files to them.

sh
curl -sS -X POST "https://api.sendbl.com/v1/requestFiles" \
  -H "x-api-key: $SENDBL_API_KEY" \
  -H "content-type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill directs users to upload raw file bytes to a presigned URL but provides no warning about the privacy, sensitivity, retention, or third-party handling implications of sending files off-platform. In an agent context, this can cause users to disclose sensitive data without informed consent, especially because presigned URLs often bypass normal application-level visibility and controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

This endpoint places the owner_token directly in the URL query string, which is risky because query parameters are commonly logged in shells, proxies, browser history, monitoring systems, and server access logs. Since the owner_token authorizes listing uploaded files, exposure of that token can enable unauthorized access to file metadata and follow-on actions.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

Requires the owner_token from step 1 (or 2).

sh
curl -sS "https://api.sendbl.com/v1/uploadedFiles?token=<owner_token>&limit=50"

Returns the array of files with file_id and filename. To get a download URL for one of them:

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

The skill again embeds the owner_token in a query string when requesting a file download link. Sensitive bearer-like tokens in URLs are prone to leakage through logs and command history, and compromise could let an attacker obtain download links for uploaded files.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

Returns the array of files with file_id and filename. To get a download URL for one of them:

sh
curl -sS "https://api.sendbl.com/v1/fileDownloadLink?token=<owner_token>&file_id=<file_id>"

5. Delete a link

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

Using the owner_token in the deletion URL is especially dangerous because any leakage of that token can enable irreversible deletion of the link and all uploaded files. Query-string exposure increases the chance that destructive credentials are captured in logs or command history and later abused.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

Requires the owner_token. Removes the link and all uploaded files.

sh
curl -sS -X DELETE "https://api.sendbl.com/v1/uploadLink?token=<owner_token>"

Confirm with the user before calling — this is irreversible.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file documents a capability to delete upload links, which can affect user data or availability, but it provides no warning that the action is destructive or may be irreversible. Under the markdown-specific warning rule, user-facing documentation should disclose potentially impactful operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.