ClawHub
Back to skill

Security audit

firebase

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Firebase management integration using Maton OAuth/CLI, with shared automation reference docs that are inert unless the user explicitly asks to use them.

Install only if you are comfortable authorizing Maton to access the intended Firebase account. Confirm every write, deletion, function deployment, trigger, or persistent destination before it runs, and treat cross-app trigger references such as HubSpot, Gmail, Stripe, and Slack as separate automations that should be used only when you explicitly request them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The Firebase skill manifest says this skill is for Firebase Management API operations and explicitly frames files under references//triggers.md as shared platform event catalogues that add no Firebase capability. This file nevertheless documents HubSpot events in detail inside the Firebase skill package, which expands the documented behavior beyond Firebase management into HubSpot-triggered automation context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Line L003 states this shared reference 'does not widen' the app the skill is about and should only be used when the user asks for that source by name. However, the remainder of the file documents a full HubSpot event catalogue with parameters and payloads, which materially supplies operational guidance for a non-Firebase source inside the Firebase skill's docs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.