ClawHub
Back to skill

Security audit

Abs Data Api

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ABS data-query helper that contacts the public ABS API, caches public metadata, and writes only user-requested outputs.

Install only if you want an Australia/ABS-specific data helper. Expect it to call the public ABS API, create a metadata cache in ~/.cache/abs-data-api, and write files when you use --out or --chart; choose output paths carefully because existing files may be overwritten.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description presents an end-user skill for answering natural-language questions about ABS statistics and returning data with citations, including comparisons and export/visualisation support. The supplied code instead is a backend/maintenance script focused on caching ABS API metadata: dataflow catalog refresh, keyword search over cached metadata, fetching dataset structures/codelists, generating metadata files from presets and overrides, and showing cache status. While it does interact with the ABS API, it does not query observations/data values, interpret user questions, produce cited answers, or create charts/CSV outputs. The code's primary purpose is materially different from the declared skill behavior, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code’s primary behavior is dataset discovery/routing: it accepts a query, scores it against a curated table of ABS datasets, detects ambiguity, and prints or emits JSON describing matching dataset IDs and clarifying questions. That is related to the declared ABS domain, but materially narrower than the declared skill purpose. The description promises querying ABS datasets and returning data with citations, including live data/time series access and visualization/export support. None of those capabilities are implemented in this chunk. The only external/resource behavior is an optional cached catalog lookup via a local module, which is still consistent with search rather than data retrieval. Therefore the description overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a user-facing ABS data query skill that interprets natural language and returns statistics with citations, comparisons, and export/visualisation capabilities. The supplied code instead is an internal validation utility: it iterates over predefined presets, fetches one latest observation from the ABS API, and prints test results. While it does access the ABS API, that is only in service of testing preset health, not fulfilling arbitrary user queries. This is a material purpose mismatch, with several declared capabilities absent from the code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest limits this skill to ABS datasets and explicitly excludes Census DataPacks, directing users to a different census-focused skill. This file states that the skill supports "Census / CED lookups when available in the ABS API," which broadens the apparent scope into census-related querying and conflicts with the declared usage boundary.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 43)May include surrounding context.

If you need to inspect it manually:

bash
mkdir -p /tmp/abs-data-api-test
unzip ~/.openclaw/workspace/skills/dist/abs-data-api.skill -d /tmp/abs-data-api-test
find /tmp/abs-data-api-test -maxdepth 3 -type f | sort

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises executable scripts that use network access, local file reads/writes, and cache management, but it declares no explicit tool scope or permissions boundary. That creates an avoidable least-privilege failure: an agent may grant broader capabilities than necessary, increasing blast radius if the skill is misused or one of the bundled scripts behaves unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The dataset catalog lists trigger/search terms such as "employment" and "participation rate" alongside the Labour Force dataset. In a markdown skill reference, these generic phrases can overlap with common user requests and there are no exclusion conditions or scope limits explaining when they should or should not activate this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
77% confidence
Finding

Terms such as "exports imports" and "merchandise exports/imports" are broad natural-language phrases that could match many general conversations unrelated to this specific ABS catalog. The file does not document boundaries, negative examples, or a constrained invocation context to prevent unintended matching.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md
SKILL_DIR = Path(__file__).parent.parent
PRESETS_FILE = SKILL_DIR / "presets.json"
BASE_URL = "https://data.api.abs.gov.au/rest"


def _get_version_from_presets(dataflow_id: str, all_presets: dict) -> str:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-guide.md (reported line 5)May include surrounding context.

md
SKILL_DIR = Path(__file__).parent.parent
PRESETS_FILE = SKILL_DIR / "presets.json"
BASE_URL = "https://data.api.abs.gov.au/rest"


def _get_version_from_presets(dataflow_id: str, all_presets: dict) -> str:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/dataset-catalog.md (reported line 171)May include surrounding context.

md
SKILL_DIR = Path(__file__).parent.parent
PRESETS_FILE = SKILL_DIR / "presets.json"
BASE_URL = "https://data.api.abs.gov.au/rest"


def _get_version_from_presets(dataflow_id: str, all_presets: dict) -> str:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/abs_cache.py (reported line 27)May include surrounding context.

python
SKILL_DIR = Path(__file__).parent.parent
PRESETS_FILE = SKILL_DIR / "presets.json"
BASE_URL = "https://data.api.abs.gov.au/rest"


def _get_version_from_presets(dataflow_id: str, all_presets: dict) -> str:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/abs_query.py (reported line 68)May include surrounding context.

python
SKILL_DIR = Path(__file__).parent.parent
PRESETS_FILE = SKILL_DIR / "presets.json"
BASE_URL = "https://data.api.abs.gov.au/rest"


def _get_version_from_presets(dataflow_id: str, all_presets: dict) -> str:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/test_presets.py (reported line 24)May include surrounding context.

python
SKILL_DIR = Path(__file__).parent.parent
PRESETS_FILE = SKILL_DIR / "presets.json"
BASE_URL = "https://data.api.abs.gov.au/rest"


def _get_version_from_presets(dataflow_id: str, all_presets: dict) -> str:

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The README frames the skill exclusively around Australian Bureau of Statistics data and Australian macro reporting outputs, which constrains locale and regional context in natural-language behavior. Because no user opt-in or explicit statement of region-specific scope is provided in the analyzed lines, this may conflict with the policy against forcing a specific locale without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This code writes query results directly to a user-specified path via Path(out_file).write_text(result). Although the --out FILE option implies file output, there is no confirmation prompt or explicit warning that an existing file may be overwritten at this point in execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The chart formatter saves an image file with plt.savefig(chart_path, dpi=120), either to a derived output path or /tmp/abs_<name>.png. While the function returns a message after saving, there is no prior warning in the command help or inline comments that enabling --chart causes a file to be written to disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.