ClawHub
Back to skill

Security audit

ScanWow Sync

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for receiving phone scan text, but its sample webhook can be exposed with a publicly known default token that allows remote writes into the agent workspace.

Review before installing or using. Do not run the sample as written on any exposed endpoint: require `SCANWOW_TOKEN` to be set, reject the placeholder value, use a dedicated scan directory instead of `.`, and put the webhook behind tunnel or proxy controls with body-size, timeout, and rate limits.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:38
Finding

Webhook Uses a Publicly Known Fallback Authentication Token

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:51
Finding

Request-Size Limit Bypass and Single-Threaded Denial of Service

Content
View full analysis
5_000_000: # 5MB safety limit self.send_response(413) self.end_headers() return post_body = self.rfile.read(content_len) data = json.loads(post_body) ``` The service is subsequently started using a single-threaded HTTP server: ```python HTTPServer(('127.0.0.1', 8000), ScanHandler).serve_forever() ``` ### Technical Analysis The size validation checks only whether `Content-Length` exceeds 5,000,000. It does not reject negative values. A negative value therefore passes the upper-bound check and is supplied to `self.rfile.read(content_len)`. In Python buffered stream semantics, a negative read size requests input until end-of-file rather than enforcing the intended five-megabyte limit. The implementation also uses the single-threaded `HTTPServer` and configures no socket read timeout. A client that declares an accepted body length but transmits the body very slowly can occupy the only request-processing thread. Other requests cannot be processed until that connection completes or terminates. Some reverse proxies may reject malformed negative `Content-Length` headers. That does not address the slow-request condition, and the server remains vulnerable when accessed through a permissive forwarding layer or directly by an actor with network reachability. ### Attack Path 1. The webhook is exposed through the recommended tunnel service. 2. An attacker obtains a valid bearer token, or uses the documented fallback token when `SCANWOW_TOKEN` was not configured. 3. The attacker opens a POST request to the webhook. 4. The attacker either: - Supplies a negative `Content-Length` through a transport path that permits it ...[truncated 1058 chars]
Remediation
View remediation
MAX_BODY_SIZE: self.send_error(413, "Request body size is invalid") return ``` Further hardening should include: 1. Configure strict connection and body-read timeouts. 2. Read the body incrementally while maintaining an independent byte counter instead of relying solely on the client-provided header. 3. Reject unsupported transfer encodings and malformed or conflicting length headers. 4. Catch JSON decoding, Unicode, socket, and I/O errors and return controlled client errors. 5. Use a production-grade application server or reverse proxy that enforces: - Maximum request-body size. - Header and body timeouts. - Concurrent connection limits. - Per-client rate limits. 6. If retaining the standard-library example, use a concurrent server such as `ThreadingHTTPServer`, while still applying strict concurrency and timeout limits. 7. Require valid authentication before reading substantial request bodies, and correct the fallback-token weakness described separately. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.