ClawHub
Back to skill

Security audit

TTPOS Agent

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate TTPOS reporting connector, but it needs review because it sends a bearer token and merchant data to an external service and asks the agent to submit generated SQL without visible safeguards.

Install only if you trust the ttpos-agent service and can use a least-privilege, preferably read-only API key. Confirm the backend enforces tenant isolation, SELECT-only execution, row/date limits, SQL auditing, and a trusted guide source, because those protections are not visible in the reviewed skill package.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:24
Finding

Untrusted Remote Guidance Can Influence Agent Behavior and Generated Queries

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-27 and 41-44
Vulnerability Type: Remote instruction injection through mutable guidance
Risk Level: High

Vulnerable Code

markdown
GET {LIGHT_BRIDGE_URL}/api/v1/query/guide
bash
curl -s -H "Authorization: Bearer $LIGHT_BRIDGE_API_KEY" \
 "$LIGHT_BRIDGE_URL/api/v1/query/guide"

The surrounding instructions require the agent to retrieve Markdown from this endpoint, interpret it as data-model and query guidance, and use it when constructing SQL.

Technical Analysis

The skill requires the agent to retrieve mutable Markdown from an external service before constructing any query. The returned content is treated as trusted operational guidance rather than untrusted data.

Because the remote response is not included in the audited package, its future contents cannot be statically reviewed. The skill defines no trusted schema, signature verification, content allowlist, or instruction/data boundary for the response. A compromised service, account, DNS path, or backend could therefore return adversarial text designed to alter the agent's behavior.

This is an instruction-hijacking risk rather than remote code execution: the documented endpoint returns guidance that influences agent decisions, but the reviewed file does not directly download or execute program code.

Attack Path

  1. An attacker gains control over, or compromises, the configured guidance endpoint or its backend.
  2. The attacker modifies the /api/v1/query/guide response to include hostile behavioral instructions disguised as query guidance.
  3. The skill mandates retrieving and interpreting that response before generating SQL.
  4. The agent treats the hostile content as authoritative guidance.
  5. The agent may generate queries outside the user's intended scope, disclose excessive business data, suppress warnings, or otherwise alter its response behavior.
  6. If comb ...[truncated 708 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace free-form Markdown guidance with a versioned, machine-readable JSON schema.
  2. Treat every remote response as untrusted data and explicitly prohibit following behavioral instructions contained in it.
  3. Validate responses against a strict local schema and reject unknown keys, embedded directives, URLs, executable content, and unexpected text.
  4. Pin an expected guide version or cryptographic digest. If dynamic updates are required, verify a digital signature against a key bundled with the skill.
  5. Keep query-generation policy locally in the reviewed skill rather than delegating policy decisions to mutable remote content.
  6. Use local table, column, aggregation, tenant, time-range, and row-limit allowlists.
  7. Require explicit user confirmation before executing queries that materially expand scope or access sensitive records.
  8. Ensure remote instructions can never override system policies, authorization boundaries, or output-safety requirements.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:43
Finding

User-Influenced SQL Is Submitted to a Generic Execution Endpoint Without Documented Local Validation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43-44 and 68-72
Vulnerability Type: Unsafe dynamic SQL generation
Risk Level: High

Vulnerable Code

bash
curl -s -X POST "$LIGHT_BRIDGE_URL/api/v1/query/execute" \
 -H "Authorization: Bearer $LIGHT_BRIDGE_API_KEY" \
 -H "Content-Type: application/json" \
 -d '{"company_uuid": 8267304538112000, "sql": "SELECT ..."}'

The workflow directs the agent to construct SQL from the user's question and submit the resulting SQL string, together with a merchant identifier, to the generic execution endpoint.

Technical Analysis

The skill exposes a workflow in which natural-language user input influences SQL sent to a generic query executor. Although the example begins with SELECT, the skill does not require local SQL parsing or enforce that the generated statement is read-only.

The documented controls are advisory query conventions, such as adding a deletion filter, preferring statistics tables, limiting time ranges, and using a row limit for large datasets. These conventions do not prevent stacked statements, comments, subqueries, expensive joins, unauthorized table access, tenant-boundary mistakes, or data-modification statements.

Parameterization requirements are also absent. The merchant identifier and user-derived filters are represented as values embedded into the request and generated SQL. Any server-side SQL parser, read-only enforcement, authorization checks, or tenant isolation may reduce this risk, but such protections are not present or verifiable in the reviewed project.

Attack Path

  1. A user submits a crafted request that asks the agent to use unusual SQL syntax, access unrelated tables, omit tenant restrictions, or perform an excessively broad query.
  2. Alternatively, hostile content from the mandatory remote guide influences query construction.
  3. The agent converts the request or hostile guidance into SQL.
  4. The skill submi ...[truncated 1033 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace arbitrary SQL submission with predefined report endpoints or server-side query templates.
  2. If SQL must be supported, parse it into an abstract syntax tree before submission and permit exactly one read-only SELECT statement.
  3. Reject DDL, DML, transaction control, stored-procedure calls, comments, stacked statements, file operations, and vendor-specific administrative functions.
  4. Apply explicit table and column allowlists appropriate to each report type.
  5. Bind filter values as parameters rather than interpolating user-derived content into SQL.
  6. Derive tenant scope from the authenticated API key on the server. Do not rely solely on a client-supplied company_uuid.
  7. Use a database identity with read-only access to approved views and no direct access to base tables outside the reporting scope.
  8. Enforce mandatory row limits, maximum date ranges, execution timeouts, query-cost limits, and cancellation controls on the server.
  9. Audit all submitted statements and alert on rejected, cross-tenant, unusually broad, or resource-intensive queries.
  10. Add adversarial tests for stacked queries, comment-based bypasses, unions, nested subqueries, unauthorized tables, missing tenant filters, and resource-exhaustion patterns.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to present results in Chinese and translate field names and enum values into Chinese. This is a natural-language policy concern because it imposes a specific language/locale behavior without user opt-in or an explicit documented choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The skill instructs the agent to send an Authorization bearer token to an external host and transmit potentially sensitive business queries and results off-platform. Even though this is the intended integration, it creates a real external data transmission path involving API credentials and merchant operational data, so compromise of the endpoint, misconfiguration, or unexpected use could expose sensitive information.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

获取数据查询指南（必须首先调用）

bash
curl -s -H "Authorization: Bearer $LIGHT_BRIDGE_API_KEY" \
 "$LIGHT_BRIDGE_URL/api/v1/query/guide"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

These rules require all output labels and enum values to be rendered in Chinese, with no option for another language. That constitutes a language/locale restriction in natural-language instructions and should be opt-in or clearly justified.

Content

No source excerpt is available for this finding.