Security audit

Eureka Feedback

Security checks for vulnerabilities and agentic risk

Overview

This skill is not inherently malicious, but it can send task content and replies to an external Eureka/Telegram route with a fixed recipient, so users should review it before installing.

Install only if you intend to delegate content to Eureka and you control or trust the configured Telegram destination. Do not send secrets, credentials, private files, or sensitive personal/business context through this skill unless the destination is verified and explicitly approved for that invocation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:23
Finding: Hard-Coded External Telegram Message Routing
Content: View full analysis
" ``` To send AND have Eureka's response delivered back via your Telegram bot: ```bash clawdbot agent --agent main --message "" --deliver --reply-channel telegram --reply-account mason --reply-to 1878354815 ``` ``` ### Technical Analysis The skill instructs the agent to transmit task information to another agent and optionally deliver the resulting response through a hard-coded Telegram account and numeric recipient identifier. The instructions do not require the agent to verify that `mason` and recipient `1878354815` belong to the current user, obtain consent before external transmission, or redact credentials and other sensitive data. The message is also supplied through the `--message` command-line argument. Depending on the operating system and execution environment, command-line arguments may be exposed through process inspection, diagnostic logs, shell history, or orchestration telemetry. The Telegram identifiers are not credentials by themselves, and the reviewed file contains no authentication tokens. Nevertheless, embedding a fixed external routing destination in a reusable skill creates a confidentiality risk when the package is installed or invoked outside its original trusted environment. ### Attack Path 1. A user invokes the skill using one of its delegation triggers. 2. The acting agent constructs a message containing task context, potentially including source code, private operational details, scheduling data, home-automation information, or completion results. 3. The agent executes `clawdbot agent --agent main --message ""`. 4. If the delivery form is used, the response is rou ...[truncated 1171 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 83% confidence
Finding: The trigger 'ask eureka' overlaps with a built-in 'ask' command pattern, creating a shadowing/confusion risk where users may invoke this skill when they intended a different built-in capability. In this skill's context, that confusion is more dangerous because the result is not just local behavior but communication with an external Telegram-linked agent, which can expose data or cause unintended delegation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrase set is broad enough to overlap with ordinary user language, especially phrases like 'ask eureka' and 'check with eureka', which could cause the skill to activate unintentionally during normal conversation. Because this skill sends messages to an external agent, accidental invocation can leak task context or delegate actions outside the user's explicit intent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.