ClawHub
Back to skill

Security audit

Pretext Reporter Bao

Security checks for vulnerabilities and agentic risk

Overview

The skill's main text-measurement API is coherent, but the published package bundles extra browser test tooling that can run local servers, automate desktop browsers, and post reports to URL-controlled endpoints.

Review this before installing in stricter environments. The normal API appears to measure and report text without automatic network or filesystem access, but avoid opening bundled diagnostic pages from untrusted links and avoid running the included Pretext development scripts unless you are comfortable with local browser automation and loopback report collection. For production use, consider trimming the bundled development pages/scripts and keeping only the dist library needed by the skill.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
pretext/pages/accuracy.ts:90
Finding

Query-Controlled Report Endpoint Enables Browser Fingerprint Disclosure

Content
View full analysis
(report: T): AccuracyReport { return requestId === undefined ? report : { ...report, requestId } } function getEnvironmentFingerprint(): EnvironmentFingerprint { return { userAgent: navigator.userAgent, devicePixelRatio: window.devicePixelRatio, viewport: { innerWidth: window.innerWidth, innerHeight: window.innerHeight, outerWidth: window.outerWidth, outerHeight: window.outerHeight, visualViewportScale: window.visualViewport?.scale ?? null, }, screen: { width: window.screen.width, height: window.screen.height, availWidth: window.screen.availWidth, availHeight: window.screen.availHeight, colorDepth: window.screen.colorDepth, pixelDepth: window.screen.pixelDepth, }, } } function publishReport(report: AccuracyReport): void { const reportJson = JSON.stringify(report) window.__ACCURACY_REPORT__ = report if (reportEndpoint !== null) { publishNavigationPhase('posting', requestId) void (async () => { try { await fetch(reportEndpoint, { method: 'POST', body: reportJson, }) publishNavigationReport(toNavigationReport(report)) } catch { // Best-effort side channel for large reports. } })() return } publishNavigationReport(toNavigationReport(report)) } ``` The fingerpr ...[truncated 4147 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (88)

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
95% confidence
Finding

This demo dataset contains explicit harmful and violent text, including content about buying murder weapons and murdering someone. While the file is not executable code, if surfaced in UI demos, prompts, or generated reports without moderation, it can expose users to unsafe content and undermine downstream safety controls.

Content

Scanner excerpt · pretext/pages/demos/masonry/shower-thoughts.json (reported line 1)May include surrounding context.

json
["Men's public restrooms are laid out all wrong. It should be urinal, stall, urinal, stall, urinal instead of urinal, urinal, urinal, stall, stall.","The 'richest people' list in actuality is the 'legally richest people', which is only close to the actual richest people list. There are tons of illegal super rich people.","When you eat at home with your partner, it's weird to eat different entrees, but when you eat at a restaurant with your partner, it's weird to eat the same entree.","In the Harry Potter Universe, technically anybody could legally and freely explore the body of anyone else if they really wanted to and whenever they wanted, so long as they had access to a single strand of that person’s hair and some Polyjuice Potion.","If you sleep 5 hours per night and die at age 75, you'll still have spent just as many years awake as a person who sleeps 8 hours per night and dies at age 89.","If you are an identical twin, there is a non-zero chance your parents got you confused for your sibling as an infant, so you aren't who you think you are.","I bet the person whose Social Security number is 420-69-8008 wishes they could tell everyone what it is.","The universe is 13.8 billion years old, but heat death is around 10¹⁰⁰ years away, so it has effectively used 0% of its lifetime meaning the universe is still basically a \"baby\", and we’re living in its earliest, most active era.","If you didn’t watch it air, you’d never be able to catch up with the Truman Show.","Aliens wouldn't invade earth to enslave humanity or for Earth's resources. Aliens can travel across the galaxy, universe, dimensions. They will have all the technological advancements and the entirety of the infinite vastness of space and all of its resources.","If the \"use it or lose it\" theory of neuroscience is correct, then we're going to have an absolute explosion of AI-induced Alzheimers in the future.","If radio was invented today it would be controlled by four companies and locked behind a paywal
...[truncated 28 chars]

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
86% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

A local HTTP listener that accepts POST requests and implements CORS materially changes the threat model by introducing an inbound network surface. If undeclared, it can be abused by other local or browser-originated contexts to send data into the skill or trigger unintended processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file contains an explicit anti-Semitic slur ('kike') in narrative dialogue. SQP-3 applies to all file types, and this is a direct natural-language policy concern even though it appears in quoted literary text.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'oxlint' resembles popular package 'eslint'

High
Category
Supply Chain
Confidence
70% confidence
Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code performs an arbitrary outbound fetch(reportEndpoint, { method: 'POST', body: JSON.stringify(report) }) using attacker-controllable query-string input. That allows silent transmission of detailed report data, including environment metadata and measured text diagnostics, to any destination chosen by whoever supplied the URL.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

const reportEndpoint = params.get('reportEndpoint') allows any URL-like value from the query string to control where reports are posted. Because the report can include widths, line content mismatches, and contextual text excerpts, this acts as an unjustified exfiltration path from browser state to an attacker-selected endpoint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code uses AppleScript via osascript to inspect and activate frontmost applications and to drive desktop browser behavior. Desktop application control is a powerful host capability unrelated to the stated text-measurement purpose, and if influenced by other code paths it could be abused to manipulate user applications, steal focus, or automate unintended actions on the local machine.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file spawns Firefox directly and launches a shell with zsh -lc to start a Bun server, which grants broad subprocess execution capability beyond the advertised tool behavior. Shell-based process launching is especially risky because it expands the opportunity for command injection, environmental abuse, and repurposing the skill into a general local execution mechanism.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire publishing guide is written in Chinese and does not indicate that other languages are supported or that the Chinese-only presentation is region-specific. Under the stated policy, forcing a specific language without user opt-in can constitute a natural-language policy violation.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · PUBLISH.md (reported line 93)May include surrounding context.

clawhub install pretext-reporter-bao

验证文件

ls -la ~/.clawhub/skills/pretext-reporter-bao

text

---

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · PUBLISH.md (reported line 113)May include surrounding context.

md
**方式 2: 通过 SKILL.md 加载**

确保 `skills/pretext-reporter-bao/SKILL.md` 存在且格式正确。

### 在代码中使用