ClawHub
Back to skill

Security audit

Lme Auto Messenger

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it handles customer personal data and automated messaging with weak safeguards around storage and send review.

Review this carefully before installing. Use it only with customer opt-in, restrict the spreadsheet range to fields needed for messaging, avoid broad bulk sends, review recipients and messages before sending, and delete or protect any exported customer JSON file immediately after use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:57
Finding

Customer PII Is Persisted in a Plaintext JSON File

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33–40 and 57–63
Vulnerability Type: Plaintext storage of sensitive customer data
Risk Level: Medium

Vulnerable Code

markdown
| Column | Content | Example |
|--------|---------|---------|
| A | Date added | 2025-10-19 |
| B | Latest message | 2025-11-06 |
| C | LINE registered name | Customer name |
| D | System display name | Display name |
| E | Email address | example@email.com |
| F | Step-delivery status | Paused |
| G onward | Category columns | User-defined |
bash
gws sheets spreadsheets values get \
  --params '{"spreadsheetId":"SPREADSHEET_ID","range":"シート1!A:K"}' \
  --format json > customers.json

Technical Analysis

The documented command exports columns A:K from the customer spreadsheet directly to customers.json. Based on the documented schema, this export includes names, email addresses, messaging activity, delivery status, and customer-interest categories.

Shell redirection creates a persistent, unencrypted file using the process's current file-creation permissions. The Skill does not require owner-only permissions, a protected destination, data minimization, encryption, a retention period, or cleanup after processing. Consequently, sensitive customer information can remain on disk beyond the messaging operation.

This is an insecure data-handling practice rather than evidence of intentional exfiltration. The audited file does not instruct the Agent to send this data to an unrelated destination.

Attack Path

  1. An operator follows the documented command while processing customer messages.
  2. Google Sheets returns customer records from columns A:K.
  3. Shell redirection writes the response as plaintext to customers.json in the current working directory.
  4. The file remains after processing because no cleanup procedure is specified.
  5. A local user, unrelated process, backup system, o ...[truncated 825 chars]
Remediation
View remediation

Remediation Suggestions

  1. Avoid persistent files by piping the JSON response directly into the authorized processing component or retaining it only in memory.
  2. Export only fields required for message generation rather than the entire A:K range. Exclude email addresses and unrelated metadata when they are unnecessary.
  3. If temporary storage is unavoidable, create a private temporary directory and enforce owner-only permissions, for example with umask 077.
  4. Use an unpredictable temporary filename instead of a fixed file in the working directory.
  5. Register cleanup so the temporary file is removed on successful completion, interruption, or error.
  6. Encrypt stored exports when processing requirements make retention necessary, and document the permitted retention period and deletion procedure.
  7. Prevent customer exports from entering source control, cloud-synchronized folders, logs, or broad backup sets.
  8. Validate that the runtime account and all downstream tools operate with least-privilege access to both the spreadsheet and temporary data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill automates retrieval of spreadsheet data containing personal information and uses it to send customer messages, but it does not provide an execution-time privacy guardrail such as data minimization, consent verification steps, recipient confirmation, or warnings before processing/sending. Because the workflow combines PII access with automated outbound messaging through Browser Relay, operator mistakes or misuse could lead to unauthorized use of customer data, privacy violations, or non-compliant bulk messaging.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.