ClawHub
Back to skill

Security audit

Synero

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform its stated Synero AI-council function, but it sends user prompts and an API key over the network and allows an environment variable to redirect that authenticated request to an arbitrary endpoint.

Review before installing. Use this only when you intend to send the prompt to Synero, avoid secrets or regulated/confidential data unless approved, keep SYNERO_API_KEY narrowly scoped and revocable, and do not set SYNERO_API_URL unless you fully trust the exact HTTPS endpoint receiving the bearer token.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/synero-council.py:19
Finding

Configurable API Endpoint Allows Bearer Credential and Prompt Disclosure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'req' from os.environ.get (line 149, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/synero-council.py (reported line 163)May include surrounding context.

python
events: dict[str, Any] = {"synthesis": "", "advisor": {}, "complete": None}

    try:
        with urllib.request.urlopen(req, timeout=REQUEST_TIMEOUT_SECONDS) as resp:
            if resp.status != 200:
                body = resp.read().decode("utf-8", errors="replace")
                raise RuntimeError(f"HTTP {resp.status}: {body[:400]}")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares environment and network capabilities through metadata but does not define an explicit permission or allowed-tools scope. That creates an authorization/consent gap: a caller may not realize the skill can transmit user prompts and environment-derived secrets to an external service, increasing the risk of unintended data exposure or overbroad execution in permissive runtimes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description is broad enough to match many common 'strategy' or 'research' requests, which can cause the skill to auto-activate in contexts where the user did not intend to send content to a third-party service. In this skill's context, overbroad activation is more dangerous because activation triggers external network transmission of potentially sensitive prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The markdown explains that prompts are sent to Synero, but it does not provide a clear, prominent user warning that user input will be transmitted to an external API service. For a judgment-oriented assistant skill, users may include proprietary plans, hiring discussions, architecture details, or other sensitive data; without an explicit warning and consent cue, this creates a meaningful data leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This script transmits the user prompt, optional thread ID, optional parent query ID, and API key to a remote service without an explicit runtime notice. In a terminal tool used for strategy, research, hiring, or architecture questions, users may paste sensitive business or personal data, so the lack of a clear disclosure increases the chance of unintended data exposure to the third-party service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.