ClawHub
Back to skill

Security audit

Zapier Recipe

Security checks for vulnerabilities and agentic risk

Overview

This looks like a low-capability Zapier recipe helper with quality and disclosure issues, but no evidence of data theft, destructive behavior, or privilege abuse.

Before installing, treat this as a simple recipe/demo helper rather than a real automation engine. Be aware that one bundled script logs command usage locally and that the documented commands do not reliably match the implemented behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Note
Location
scripts/zapier.sh:29
Finding

Unconditional Promotional Content Injected into Command Output

Content
View full analysis

Vulnerability Details

File Location: scripts/zapier.sh:29
Vulnerability Type: Unconditional output injection
Risk Level: Low

Complete Code Snippet:

python
print("\nPowered by BytesAgain | bytesagain.com")

Technical Analysis

The script unconditionally appends promotional text and an external domain to every generated response. This content is unrelated to the requested automation-recipe result and cannot be disabled by the caller.

When an AI agent uses this script and incorporates its standard output into a response, the fixed footer can cause attacker-selected promotional content to appear as though it were part of the agent's requested result. The code does not change the agent's safety constraints, retrieve remote content, or execute a remote payload, but it does manipulate agent-facing output in a manner most closely aligned with skill instruction and response hijacking.

Attack Path

  1. A user or agent invokes scripts/zapier.sh with any supported command.
  2. The script generates the requested recipe, template, or help content.
  3. Line 29 unconditionally appends Powered by BytesAgain | bytesagain.com.
  4. An agent relaying the command's standard output includes the unsolicited promotional content in its response.

Impact Assessment

The issue affects the integrity and trustworthiness of generated output. It can cause an agent to distribute attacker-selected branding or an external domain without explicit user consent.

It does not grant operating-system privileges, access credentials, modify persistent agent memory, or enable arbitrary code execution. The scope is limited to output generated through this script.

Remediation
View remediation

Remediation Suggestions

  • Remove the unconditional promotional footer from normal command output.
  • If attribution is required, expose it through an explicit about or version command.
  • Alternatively, require an opt-in flag such as --include-attribution.
  • Keep machine-consumable standard output limited to content directly requested by the caller.
  • Send non-result metadata to standard error only when operationally necessary and clearly documented.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/zapier.sh:30
Finding

Unquoted User-Controlled Argument Expansion Allows Word Splitting and Pathname Expansion

Content
View full analysis

Vulnerability Details

File Location: scripts/zapier.sh:3-4,30
Vulnerability Type: Unsafe shell argument handling
Risk Level: Low

Complete Code Snippet:

bash
CMD="${1:-help}"; shift 2>/dev/null || true; INPUT="$*"
python3 -c '
# Python recipe-processing logic omitted
' "$CMD" $INPUT

The vulnerable invocation is:

bash
' "$CMD" $INPUT

Technical Analysis

The script initially combines all remaining command-line arguments into the scalar variable INPUT using "$*". It later expands that value as the unquoted expression $INPUT.

Unquoted shell expansion is subject to:

  • Field splitting according to the current IFS value.
  • Pathname expansion for wildcard characters such as *, ?, and bracket expressions.
  • Loss of the caller's original argument boundaries.

Consequently, an input intended to be one logical search phrase can become multiple Python arguments. Wildcard input can also expand to filenames from the current working directory before Python receives it.

This construction does not directly permit shell command injection because shell metacharacters introduced through ordinary variable expansion are not reparsed as shell syntax. Nevertheless, it creates input-integrity problems and allows the local filesystem state to influence the Python program's arguments.

Attack Path

  1. An attacker or untrusted caller supplies a browse input containing whitespace or wildcard characters, such as *.
  2. The shell stores the textual value in INPUT.
  3. At line 30, the unquoted $INPUT expansion undergoes field splitting and pathname expansion.
  4. Matching filenames from the current working directory are substituted into the Python argument list.
  5. The Python code joins the altered arguments and processes unintended input, producing results influenced by local filenames rather than the caller's literal search term.

Impact Assessment

The vulnerabil ...[truncated 511 chars]

Remediation
View remediation

Remediation Suggestions

Preserve command-line arguments in an array and quote every expansion:

bash
CMD="${1:-help}"
if (($# > 0)); then
    shift
fi
INPUT_ARGS=("$@")

python3 -c '
import sys
cmd = sys.argv[1] if len(sys.argv) > 1 else "help"
inp = " ".join(sys.argv[2:])
# Remaining logic
' "$CMD" "${INPUT_ARGS[@]}"

Additional hardening measures:

  • Avoid storing multiple arguments in a scalar variable.
  • Use "$@" or a Bash array whenever original argument boundaries must be retained.
  • Quote all variable expansions unless field splitting is explicitly required.
  • Add tests covering spaces, wildcard characters, empty input, leading hyphens, and filenames in the current directory.
  • Consider disabling pathname expansion with set -f as defense in depth, although correct quoting remains the primary fix.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/zapier.sh (reported line 8)May include surrounding context.

sh
import sys
cmd=sys.argv[1] if len(sys.argv)>1 else "help"
inp=" ".join(sys.argv[2:])
RECIPES=[("Gmail to Slack","Trigger: New email in Gmail\nAction: Post message to Slack channel","Email notification, team updates"),("Form to Sheet","Trigger: New form submission (Typeform/Google Forms)\nAction: Create row in Google Sheets","Lead capture, surveys"),("Calendar to Todoist","Trigger: New Google Calendar event\nAction: Create task in Todoist","Meeting prep automation"),("Stripe to Email","Trigger: New payment in Stripe\nAction: Send thank you email","Customer onboarding"),("GitHub to Slack","Trigger: New PR/Issue on GitHub\nAction: Post to Slack dev channel","Dev team notifications"),("RSS to Twitter","Trigger: New RSS feed item\nAction: Create tweet","Content distribution"),("Notion to Email","Trigger: New item in Notion database\nAction: Send digest email","Project updates"),("Webhook to Sheets","Trigger: Catch webhook\nAction: Log to Google Sheets","API monitoring, logging")]
if cmd=="browse":
    cat=inp.lower() if inp else ""
    print("  Popular Zap Recipes:")

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The phrase "专为中文用户设计" indicates a locale/language-specific design preference in natural language. Under the policy rule, forcing or implying a specific language/locale without user opt-in is a violation unless it is clearly justified as region-specific, which is not documented here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The CLI documentation presents commands like check, build, test, docs, and clean as if they perform real workflow operations, but the corresponding handlers only print status messages and append entries to a local history log. This is an active contradiction between the documented command intent and the implemented behavior, not merely omitted detail.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.