ClawHub
Back to skill

Security audit

Quantinuumclaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent quantum-app starter kit, but it asks users to deploy public cloud services and handle secrets with unsafe defaults that need careful review.

Review and harden this before installation or use: avoid real PHI/PII, do not use the one-command deploy path for production, do not put API keys in VITE_* frontend variables, inspect any Fly.io installer before running it, replace placeholder dependency guidance with verified pinned packages, and manually review exactly which secrets are uploaded to Fly.io.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/flyio_config.md:20
Finding

Unverified Remote Installer Is Piped Directly into a Shell

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/flyio_deploy.py:27
Finding

Fly.io Secrets Are Exposed in Plaintext Command Logs and Process Arguments

Content
View full analysis
Remediation
View remediation
--app {app_name}") ``` Raised exceptions must also use the redacted representation rather than joining the original argument list. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error
Location
assets/selene-template/main.py:128
Finding

Public Quantum API Is Deployed Without Authentication, Authorization, or Enforced Rate Limits

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
assets/lovable-template/src/lib/api.ts:3
Finding

Frontend API Key Is Embedded in Public Vite Assets

Content
View full analysis
{ const apiKey = import.meta.env.VITE_API_KEY if (apiKey) { config.headers.Authorization = `Bearer ${apiKey}` } return config }, (error) => Promise.reject(error) ) ``` The same pattern is also recommended in `references/lovable_patterns.md:50-65`. ### Technical Analysis Vite statically replaces `import.meta.env.VITE_*` references during frontend builds. Consequently, `VITE_API_KEY` is not a protected runtime secret: it becomes part of browser-delivered JavaScript or is directly visible in outgoing HTTP requests. Any visitor can inspect the compiled bundle, browser developer tools, or network traffic and recover the bearer value. A single shared frontend key also cannot reliably identify individual users or constrain access by user. The bearer-header behavior documented in `references/selene_api.md` is normal authentication transport to an operator-configured endpoint and is not evidence of unauthorized exfiltration. The vulnerability is storing a privileged shared credential in the browser bundle. ### Attack Path 1. An operator sets `VITE_API_KEY` during the frontend build or deployment. 2. Vite substitutes the value into the compiled static JavaScript. 3. A visitor downloads the JavaScript or observes an API request in browser developer tools. 4. The visitor extracts the bearer token. 5. The visitor sends direct requests to the backend using the stolen token, bypassing frontend restrictions. ### Impact Assess ...[truncated 311 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/lovable_integrate.py:89
Finding

Untrusted CLI Values Are Interpolated Directly into Generated Executable Source

Content
View full analysis
path.replace(/^\\/api/, '') }} }} }} }}) ''' ``` User-provided values are also inserted into TSX: ```python APP_TSX = '''import {{ QueryClient, QueryClientProvider, }} from '@tanstack/react-query' import {{ QuantumDashboard }} from './components/QuantumDashboard' const queryClient = new QueryClient() function App() {{ return (

{app_name}

Quantum {quantum_use_case} powered by Guppy/Selene

``` The interpolated files are written without validation or context-specific escaping: ```python (project_dir / "vite.config.ts").write_text(VITE_CONFIG.format(backend_url=backend_url)) print(" ✓ Created vite.config.ts") (project_dir / "index.html").write_text( INDEX_HTML.format(app_name=app_name, quantum_use_case=quantum_use_case) ) print(" ✓ Created index.html") (src_dir / "App.tsx").write_text( APP_TSX.format( app_name=app_name, quantum_use_case=quantum_use_case, backend_url=backend_url ) ) ``` The values originate directly from CLI argu ...[truncated 1985 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:140
Finding

Instructions Recommend Installing an Ambiguous Unpinned Guppy Package

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (62)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description promises a specialized skill for building and deploying quantum computing applications, including healthcare-oriented use cases and cloud/deployment integrations. The actual code chunk does not implement any of that functionality. It only configures a local Vite development server for a React app and proxies API calls to a localhost backend. This is a materially different primary purpose from the declared description, so it is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description is broader and more operational than the code. This script only scaffolds frontend files for a React/Vite app and configures them to call a presumed backend URL. It does not deploy anything, provision infrastructure, communicate with Fly.io, invoke quantum services, or implement healthcare-specific features. While it is related to integrating quantum results into a user-facing interface, the primary behavior is much narrower than the declared purpose, so this is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md
python3 scripts/lovable_integrate.py \

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
python3 scripts/lovable_integrate.py \

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/selene-template/README.md (reported line 14)May include surrounding context.

  1. Configure environment:
    bash
    cp .env.example .env
# Edit .env to set QUANTUM_HARDWARE if using real hardware

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/selene-template/README.md (reported line 15)May include surrounding context.

  1. Configure environment:

    bash
    cp .env.example .env
# Edit .env to set QUANTUM_HARDWARE if using real hardware

  2. Customize the quantum algorithm:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/flyio_config.md (reported line 162)May include surrounding context.

  1. Configure environment:

    bash
    cp .env.example .env
# Edit .env to set QUANTUM_HARDWARE if using real hardware

  2. Customize the quantum algorithm:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/flyio_config.md (reported line 163)May include surrounding context.

  1. Configure environment:

    bash
    cp .env.example .env
# Edit .env to set QUANTUM_HARDWARE if using real hardware

  2. Customize the quantum algorithm:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_selene_service.py (reported line 233)May include surrounding context.

python
2. **Configure environment:**
   ```bash
   cp .env.example .env
   # Edit .env to set QUANTUM_HARDWARE if using real hardware
   ```

3. **Customize the quantum algorithm:**

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_selene_service.py (reported line 321)May include surrounding context.

python
2. **Configure environment:**
   ```bash
   cp .env.example .env
   # Edit .env to set QUANTUM_HARDWARE if using real hardware
   ```

3. **Customize the quantum algorithm:**

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_selene_service.py (reported line 322)May include surrounding context.

python
2. **Configure environment:**
   ```bash
   cp .env.example .env
   # Edit .env to set QUANTUM_HARDWARE if using real hardware
   ```

3. **Customize the quantum algorithm:**

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_selene_service.py (reported line 373)May include surrounding context.

python
2. **Configure environment:**
   ```bash
   cp .env.example .env
   # Edit .env to set QUANTUM_HARDWARE if using real hardware
   ```

3. **Customize the quantum algorithm:**

Instruction Override

High
Category
Prompt Injection
Confidence
70% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · assets/selene-template/README.md (reported line 150)May include surrounding context.

md
| `PORT` | Service port (Fly.io sets this) | No (default: 8080) |
| `QUANTUM_HARDWARE` | Hardware target: h2, h1, emulator | No |
| `QUANTUM_API_KEY` | Quantinuum API key for real hardware | Only for real hardware |
| `DEBUG` | Enable debug mode | No (default: false) |

### fly.toml Configuration

Known Vulnerable Dependency: fastapi==0.104.1 — 1 advisory(ies): CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High
Category
Supply Chain
Confidence
97% confidence
Finding

The file pins FastAPI to version 0.104.1, and the static analysis reports a known high-severity advisory (CVE-2024-24762) affecting that version. Because this template is for building deployable web APIs, shipping a vulnerable framework version can expose downstream applications to exploitable request-handling or API-layer weaknesses in real deployments.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High
Category
Supply Chain
Confidence
70% confidence
Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

Piping a remote script directly into the shell executes code fetched over the network without integrity verification, pinning, or prior review. If the remote endpoint, transport, or upstream script is compromised, users can suffer arbitrary code execution on their local machine or CI runner.

Content

Scanner excerpt · references/flyio_config.md (reported line 21)May include surrounding context.

bash
# 1. Install flyctl
curl -L https://fly.io/install.sh | sh

# 2. Login
fly auth login

Chaining Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/flyio_config.md (reported line 21)May include surrounding context.

bash
# 1. Install flyctl
curl -L https://fly.io/install.sh | sh

# 2. Login
fly auth login

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The script automatically reads a local .env-style file and prepares to push its contents into Fly.io secrets, which can transfer sensitive credentials to a remote platform with little operator scrutiny. In this healthcare/clinical deployment context, bulk-importing environment variables increases the chance of unintentionally exporting development, test, or regulated secrets to the wrong cloud app or tenant.

Content

Scanner excerpt · scripts/flyio_deploy.py (reported line 78)May include surrounding context.

python
print(f"✅ App created")

def configure_secrets(app_name, env_file_path):
    """Set secrets on Fly.io from .env file"""
    print(f"\n🔐 Configuring secrets for {app_name}")

    if not env_file_path.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The secret-loading workflow trusts any existing .env path and does not distinguish between safe local configuration and highly sensitive credentials that should never be propagated automatically. This can cause accidental credential exposure to cloud deployment targets, especially dangerous given the skill's focus on clinical and healthcare projects where credentials may guard protected data and regulated systems.

Content

Scanner excerpt · scripts/flyio_deploy.py (reported line 82)May include surrounding context.

python
print(f"\n🔐 Configuring secrets for {app_name}")

    if not env_file_path.exists():
        print(f"⚠️  .env file not found at {env_file_path}. Skipping secrets.")
        return

    # Read .env file

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

This code reads every non-comment key/value pair from the .env file and uploads them, creating a mass-secret exfiltration path from local developer storage to remote Fly.io configuration. Because there is no filtering, classification, or review step, sensitive tokens unrelated to the deployed service could be uploaded inadvertently.

Content

Scanner excerpt · scripts/flyio_deploy.py (reported line 85)May include surrounding context.

python
print(f"⚠️  .env file not found at {env_file_path}. Skipping secrets.")
        return

    # Read .env file
    secrets = {}
    for line in env_file_path.read_text().splitlines():
        line = line.strip()

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The script defaults to consuming .env from the service directory during deployment preparation, which makes secret export automatic rather than deliberate. In a healthcare-oriented skill, this increases the operational risk of pushing credentials tied to PHI-bearing systems or other regulated services into the wrong environment.

Content

Scanner excerpt · scripts/flyio_deploy.py (reported line 166)May include surrounding context.

python
# Step 3: Configure secrets
        if not args.skip_secrets:
            env_file = service_dir / ".env"
            if not env_file.exists():
                env_file = service_dir / ".env.example"
                print(f"⚠️  .env not found, using .env.example as reference")

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Falling back to .env.example as a source for secret configuration is dangerous because example files are often committed, stale, shared, or attacker-modifiable; if populated with real-looking values, they may be uploaded to production or used to poison deployment configuration. This is particularly risky in an agent skill where repository content must be treated as untrusted and where cloud deployment actions have real external side effects.

Content

Scanner excerpt · scripts/flyio_deploy.py (reported line 169)May include surrounding context.

python
env_file = service_dir / ".env"
            if not env_file.exists():
                env_file = service_dir / ".env.example"
                print(f"⚠️  .env not found, using .env.example as reference")
            configure_secrets(args.app_name, env_file)

        # Step 4: Deploy (unless setup-only)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/lovable_integrate.py (reported line 462)May include surrounding context.

python
.gitignore_content = '''node_modules/
dist/
.env.local
.env.*.local
*.log
.DS_Store

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_selene_service.py (reported line 383)May include surrounding context.

python
print(f"\n✅ Selene service created at: {project_dir}")
    print(f"\nNext steps:")
    print(f"1. cd {project_dir}")
    print(f"2. Install dependencies and configure .env")
    print(f"3. Implement actual Guppy algorithm in main.py")
    print(f"4. Test locally: python main.py")
    print(f"5. Deploy: fly launch --now")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README promotes one-command generation, deployment, and public frontend/backend wiring for clinical use cases without giving an immediate, prominent warning about sensitive health data, endpoint exposure, authentication, or data minimization in the same workflow section. In a healthcare-themed skill, this omission can lead users to rapidly deploy internet-accessible services that process clinical inputs before they have added auth, restricted CORS, or ensured de-identification, increasing the likelihood of data exposure or unsafe handling.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
assets/lovable-template/src/lib/api.ts:16

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/lovable_patterns.md:63