ClawHub
Back to skill

Security audit

Sprint OS

Security checks for vulnerabilities and agentic risk

Overview

Sprint OS is mostly a disclosed productivity workflow, but its automatic sprint logging and optional unauthenticated Convex backend create real privacy and data-integrity review concerns.

Install only if you are comfortable with an agent writing ongoing sprint logs. Do not enable CONVEX_SPRINT_URL for sensitive projects unless you add authentication to the Convex routes, restrict who can read/write the backend, and understand exactly what sprint data will be sent. Pin and review the Convex dependency before running the setup commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/convex-setup.md:65
Finding

Unauthenticated Convex HTTP Routes Permit Unauthorized Data Access and Modification

Content
View full analysis
{ const body = await request.json(); await ctx.runMutation(api.sprints.log, body); return new Response(JSON.stringify({ ok: true }), { headers: { "Content-Type": "application/json" }, }); }), }); // Get recent sprints http.route({ path: "/sprints/recent", method: "GET", handler: httpAction(async (ctx, request) => { const url = new URL(request.url); const project = url.searchParams.get("project") ?? ""; const limit = parseInt(url.searchParams.get("limit") ?? "10"); const results = await ctx.runQuery(api.sprints.recent, { project, limit }); return new Response(JSON.stringify(results), { headers: { "Content-Type": "application/json" }, }); }), }); // Record a metric http.route({ path: "/metrics/record", method: "POST", handler: httpAction(async (ctx, request) => { const body = await request.json(); await ctx.runMutation(api.metrics.record, body); return new Response(JSON.stringify({ ok: true }), { headers: { "Content-Type": "application/json" }, }); }), }); // Content dedup search http.route({ path: "/content/search", method: "GET", handler: httpAction(async (ctx, request) => { const url = new URL(request.url); const query = url.searchParams.get("query") ?? ""; const results = await ctx.runQuery(api.content.search, { query }); return new Response(JSON.stringify(results), { headers: { "Content-Type": "application/json" }, }); }), }); ``` ### Technical Analysis The documented Convex backend exposes read and write routes without verifying an authenticated ident ...[truncated 2074 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/convex-setup.md:15
Finding

Setup Instructions Install and Execute an Unpinned Third-Party Dependency

Content
View full analysis
Remediation
View remediation
``` 2. Include a committed `package.json` and lockfile generated from the reviewed dependency graph. 3. Instruct users to install dependencies with: ```bash npm ci ``` 4. Invoke the pinned local binary, for example through an npm script or `./node_modules/.bin/convex`, rather than allowing `npx` to retrieve an unreviewed package. 5. Review package provenance, checksums, maintainers, release notes, and transitive dependency changes before upgrades. 6. Use automated dependency scanning and lockfile review in CI. 7. Run setup and deployment under a least-privileged account without unrelated secrets in its environment. 8. Where practical, disable installation scripts during dependency acquisition and explicitly review any lifecycle scripts that are required. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/log-sprint.sh:108
Finding

Unescaped CLI Arguments Are Interpolated Directly into a JSON Request

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md
---

## Sprint Rules

- Every sprint MUST produce a shippable artifact
- If >5 minutes, break into smaller sprints

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation conditions are broad and include generic scenarios like starting a new project or wanting structure, which can cause the skill to be invoked in contexts where the user did not explicitly consent to its logging and autonomous execution behaviors. Because the skill also encourages immediate execution and persistent logging, unintended activation can lead to unnecessary file writes or network use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to write sprint logs to disk and optionally POST them to a Convex endpoint, but it does not require a prominent user-facing warning or consent flow before persistence and external transmission occur. This creates a privacy and data-governance risk, especially if task details, project names, metrics, or other sensitive work context are included in the logs.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The documented curl example and surrounding instructions normalize sending structured sprint data to an external endpoint defined by environment variable. Even without embedded credentials, this enables outbound transmission of potentially sensitive operational data, and if the endpoint is misconfigured or attacker-controlled, it can exfiltrate project activity and metadata.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

Sprint Log Payload

bash
curl -X POST $CONVEX_SPRINT_URL/sprints/log \
  -H "Content-Type: application/json" \
  -d '{
    "sprintId": 1,

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The setup states Sprint OS will "automatically start logging to Convex on every step 7" once CONVEX_SPRINT_URL is configured, but it does not provide a prominent warning about ongoing transmission of sprint data to a remote third-party backend. This can lead users to unknowingly send potentially sensitive project, task, metric, or content data off-host, creating privacy, confidentiality, and compliance risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The script can transmit task, project, workstream, artifact, metric, and status data to an externally supplied endpoint via CONVEX_SPRINT_URL. Because the destination is controlled by environment configuration and there is no allowlist, validation, or explicit consent at runtime, sensitive operational data can be exfiltrated if the variable is misconfigured or maliciously set.

Content

Scanner excerpt · scripts/log-sprint.sh (reported line 124)May include surrounding context.

sh
}
EOF
)
  HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST "${CONVEX_URL}/sprints/log" \
    -H "Content-Type: application/json" \
    -d "$PAYLOAD")

Static analysis

No suspicious patterns detected.