ClawHub
Back to skill

Security audit

aeo

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent website-audit helper with disclosed network and limited file-write behavior, though users should notice the monitor history and fix workflows.

Install/use this for AEO and website audits when you are comfortable running the pinned npm tool against the named site or local build. Be careful with private preview URLs and monitor mode because audit results may be stored locally, and review any proposed fixes before allowing edits.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
90% confidence
Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.

text

- Pass the explicit `http://` scheme for local dev servers — a bare host defaults to `https://`.
- The relaxation is scoped to the **single host named on the CLI**, evaluated per hop. A redirect or sitemap `<loc>` pointing at any other private host (e.g. `169.254.169.254`) stays blocked.
- To audit a whole local site whose sitemap hardcodes the prod domain, combine with sitemap origin rewriting:

```bash

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

MCP server references in the skill manifest without version pinning are a rug-pull risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill allows the agent to infer modes from broad user intent and default to audit when no explicit mode is given. In a security-sensitive skill that can access network targets, local paths, and perform writes in some modes, ambiguous activation increases the chance of the agent taking unintended actions or running broader scans than the user clearly requested.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The monitoring workflow states that it saves current results in .aeo-audit-history/ without clearly warning the user that local files will be written. Silent persistence is risky because it can surprise users, leak scanned target metadata into the workspace, or create unintended state that later automation consumes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.