ClawHub
Back to skill

Security audit

Admapix Ice

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly fits its ad analytics purpose, but its deep research flow exposes the user's API key to a second service and uses unsafe command patterns that warrant review before installation.

Review this skill carefully before installing. Basic AdMapix API use is expected, but deep research requests may send your API key and query context to deepresearch.admapix.com, and the provided shell commands have unsafe quoting and unbounded polling. Use only with a limited/rotatable API key and consider avoiding deep research flows until the publisher removes raw key forwarding, replaces the shared bearer token, safely serializes request bodies, and adds timeouts/user cancellation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:110
Finding

AdMapix API Key Disclosed to a Secondary Research Service

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:110
Finding

Shell Command Injection Through Unescaped User Query and Context

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:110
Finding

Hardcoded Shared Bearer Token Embedded in Public Skill Instructions

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:98
Finding

Mandatory External-Link Promotion and Agent Response Control

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
Findings (20)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The deep research flow explicitly forwards the user's AdMapix API key to a separate service, deepresearch.admapix.com, rather than keeping the credential scoped to the primary API. This expands the trust boundary and creates a credential-sharing path that could enable misuse of the user's account, unauthorized API consumption, or broader compromise if the secondary service is breached.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 373)May include surrounding context.

md
**Reuse data:** If the user asks follow-up questions about already-fetched data, analyze existing results first. Only make new API calls when needed.

## Output Guidelines

1. **Language consistency** — ALL output (headers, labels, insights, hints, errors, disclaimers) must match the user's detected language. See "Language Handling" section above.
2. **Route-appropriate output** — Don't force H5 links on analytical questions; don't dump tables for browsing

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to run npx clawhub install admapix without pinning a specific package version. This can cause execution of whatever version is current at install time, increasing supply-chain risk if a future release is compromised, maliciously replaced, or unexpectedly changes behavior. Because this is an installation command in user-facing documentation, it directly influences how users fetch and execute code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The README instructs users to run npx clawhub install admapix without pinning a specific version of the package or installer. Unpinned npx execution pulls the latest published package at install time, which creates a supply-chain risk: a compromised publisher account, typosquat, or malicious update could cause arbitrary code to run on the user's machine during installation. In the context of an AI skill intended for broad installation, this increases exposure because users are likely to copy-paste the command directly.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

bash
# GET
curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" \
  -H "X-API-Key: $ADMAPIX_API_KEY"

# POST

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

bash
# GET
curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" \
  -H "X-API-Key: $ADMAPIX_API_KEY"

# POST

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

bash
# GET
curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" \
  -H "X-API-Key: $ADMAPIX_API_KEY"

# POST

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This external transmission is materially different from the normal product API call because it sends the user's API key to a separate deepresearch.admapix.com service along with the user's query/context. That introduces third-party credential exposure and increases the blast radius if the secondary service is compromised, misconfigured, or logs request bodies insecurely.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

Run this exact command (only replace {user_query} and {additional_context}):

bash
curl -s -X POST "https://deepresearch.admapix.com/research" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer test-local-token-2026" \
  -d '{"project": "admapix", "query": "{user_query}", "context": "{additional_context}", "api_key": "'"$ADMAPIX_API_KEY"'"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill sends the user's API key to a secondary deep research service without prominently warning the user in the skill description or obtaining explicit consent. Even if the transfer is functionally intended, the lack of transparent disclosure undermines informed consent and increases the risk of silent credential exposure to an additional processor.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file instructs the skill to append the full report link from output.files[0].url, which is shown as a deepresearch.admapix.com URL. Later, the output guidelines explicitly say to never output upstream URLs or internal implementation details. These instructions directly contradict each other about whether backend service URLs should be exposed to the user.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 122)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 139)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 177)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 191)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 192)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 193)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 194)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions require the assistant to detect the user's language from the first message and then make all output match that detected language. This imposes a language policy automatically rather than offering a choice or confirming preference, which can conflict with organizational language/locale choice requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file documents use of a sensitive credential ($ADMAPIX_API_KEY) but does not include any warning about protecting the key, avoiding exposure in logs, or storing it securely. Under the markdown variant of the rule, documentation should warn about behaviors affecting privacy or system integrity when credentials are involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This markdown file documents use of an API key through the X-API-Key: $ADMAPIX_API_KEY header, which involves sensitive credential handling. The page does not include any warning or caution about protecting the key, avoiding accidental exposure in logs, or storing it securely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.