ClawHub
Back to skill

Security audit

Tinyfish Agent Run

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small, disclosed TinyFish integration that sends a user-provided URL and goal to TinyFish and streams the remote agent's progress back.

Install only if you trust TinyFish with the URLs and task instructions you provide. Avoid internal sites, credential-bearing links, confidential business data, personal data, or regulated content unless your organization has approved sharing that data with TinyFish.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill invokes a shell script (`scripts/agent-run.sh`) but does not declare corresponding permissions/capabilities in a way that lets users or host systems clearly understand what execution rights are needed. This creates a transparency and governance gap: the skill can perform shell-based actions and network requests without an explicit permission declaration, increasing the chance of unintended execution in environments that rely on metadata for policy enforcement.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill documentation describes passing a user-supplied URL and goal to an external TinyFish endpoint, but it does not explicitly warn users that these inputs are transmitted to a third-party service. This is dangerous because goals may contain sensitive instructions, internal URLs, credentials, or proprietary data, and users may disclose them without realizing they leave the local environment.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script transmits the user-supplied URL and goal, along with an API key, to a third-party remote service without any runtime consent prompt, validation, or warning to the caller that their inputs will leave the local environment. In a skill context, users may provide sensitive internal URLs, session-bearing targets, or confidential task instructions, so silent external transmission creates a real privacy and data-handling risk even if it is the expected product behavior.

External Transmission

Medium
Category
Data Exfiltration
Content
# Each SSE frame starts with "data: ". Strip that prefix, drop blank lines and
# keepalive comments, and print the JSON payload one-per-line so callers can
# consume events as they stream in.
curl -sN -X POST "https://agent.tinyfish.ai/v1/automation/run-sse" \
  -H "X-API-Key: ${TINYFISH_API_KEY}" \
  -H "Content-Type: application/json" \
  -H "Accept: text/event-stream" \
Confidence
89% confidence
Finding
This code performs an outbound POST to an external API and includes user-controlled data in the request body, which means any sensitive target URLs or task instructions are disclosed to a third party. In an agent skill, this is more dangerous because the purpose is autonomous browsing against arbitrary URLs, so users may unintentionally send internal endpoints, secrets embedded in URLs, or sensitive operational objectives off-platform.

Static analysis

No suspicious patterns detected.