ClawHub
Back to skill

Security audit

EzyHost

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent EzyHost API helper, but it under-declares credential use and exposes many destructive account actions without clear confirmation guidance.

Install only if you trust EzyHost with the API key and are comfortable with an agent managing hosted projects, files, domains, teams, captured emails, and API keys. Require explicit confirmation before any delete, rollback, domain, team, email export, or API-key action, and treat EZYHOST_API_KEY as a secret despite the manifest saying credentials are not sensitive.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:7
Finding

API Credential Access Incorrectly Declared as Non-Sensitive

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The documented DELETE /api/projects/:id operation is inherently dangerous because a parameterized destructive endpoint can be invoked on the wrong project if an agent mis-resolves or is prompted with a malicious ID. The context increases risk because deletion is irreversible and removes all associated files from storage.

Content

Scanner excerpt · skill.md (reported line 93)May include surrounding context.

Delete Project

text
DELETE /api/projects/:id

Deletes the project and all associated files from storage. This cannot be undone.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Deleting files by projectId and fileId is a legitimate feature, but parameterized destructive actions are susceptible to accidental or malicious misuse if an agent accepts untrusted identifiers. Without guidance to validate object ownership and confirm targets, important site assets could be removed unexpectedly.

Content

Scanner excerpt · skill.md (reported line 117)May include surrounding context.

Delete a File

text
DELETE /api/upload/:projectId/files/:fileId

Bulk Delete Files

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
87% confidence
Finding

Deleting captured emails is a destructive action against potentially business-relevant records and privacy-related data. An agent could be induced to delete the wrong record or erase audit-relevant entries if it accepts arbitrary IDs without verification.

Content

Scanner excerpt · skill.md (reported line 284)May include surrounding context.

Delete a Captured Email

text
DELETE /api/emails/:projectId/:emailId

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
88% confidence
Finding

Removing a team member is a permission-affecting destructive action that can disrupt collaboration or revoke access from the wrong person if identifiers are mishandled. In agent workflows, free-form parameter use makes this endpoint prone to abuse or mistakes.

Content

Scanner excerpt · skill.md (reported line 322)May include surrounding context.

Remove Team Member

text
DELETE /api/teams/:teamId/members/:memberId

Leave Team

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
92% confidence
Finding

Deleting a team is a high-impact destructive operation that can remove a collaboration structure and potentially disrupt access and administration for multiple users. The skill does not add any safety guidance around confirmation or target verification, increasing the risk of agent misuse.

Content

Scanner excerpt · skill.md (reported line 332)May include surrounding context.

Delete Team

text
DELETE /api/teams/:teamId

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
86% confidence
Finding

Removing a custom domain can cause service disruption, broken links, and loss of expected routing if done on the wrong project. Because this is a parameterized destructive action with operational impact, agent misuse or prompt-injected IDs could produce an outage-like effect.

Content

Scanner excerpt · skill.md (reported line 357)May include surrounding context.

Remove Domain

text
DELETE /api/domains/:projectId

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
83% confidence
Finding

Deleting AI builder templates is a legitimate management action, but it is still a destructive parameterized endpoint that can remove reusable assets if an agent is tricked into using the wrong template ID. The risk is lower than project deletion but still real in an automated setting.

Content

Scanner excerpt · skill.md (reported line 400)May include surrounding context.

GET /api/aibuilder/templates/:id — get template details POST /api/aibuilder/templates — save new template PATCH /api/aibuilder/templates/:id — update template DELETE /api/aibuilder/templates/:id — delete template

text

Template body: `{ "name": "My Template", "description": "...", "messages": [...], "files": [...] }`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Revoking the current API key is a high-impact security and availability action because it immediately invalidates access for the skill and any dependent automation. An agent tricked into calling this endpoint could cause denial of service for legitimate workflows and force emergency key rotation.

Content

Scanner excerpt · skill.md (reported line 425)May include surrounding context.

Revoke Key

text
DELETE /api/apikey

Scope Creep

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest declares sensitive_data.credentials: false even though the skill explicitly requires and uses EZYHOST_API_KEY for authenticated API calls. This can cause downstream policy engines or users to underestimate the sensitivity of the environment variable and permit unsafe handling, logging, or exposure of the key.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill includes an irreversible project deletion endpoint but does not instruct the agent to obtain explicit confirmation before invoking it. In an agentic workflow, lack of a confirmation guard materially raises the risk of accidental destructive actions and permanent data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill documents exporting captured emails as CSV without any warning that this data is personally identifiable information. In an agent context, omission of privacy handling guidance increases the chance that user email lists are exported, stored, or shared without appropriate consent, minimization, or access controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 540)May include surrounding context.

bash
# 1. Check subdomain availability
curl https://ezyhost.io/api/projects/check-subdomain/my-site \
  -H "x-api-key: $EZYHOST_API_KEY"

# 2. Create a project

Static analysis

No suspicious patterns detected.