ClawHub
Back to skill

Security audit

ModelReady

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but its default server settings can expose an unauthenticated model API to the network without clear warning.

Review before installing. Use this only if you understand that it can start a long-running vLLM server and, by default, may listen on all network interfaces. Prefer binding to 127.0.0.1, avoid sending sensitive prompts to remote or untrusted hosts, and stop the server when finished.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
tool/modelready.sh:42
Finding

Unauthenticated model API exposed on all network interfaces by default

Content
View full analysis
"$LOG_FILE" 2>&1 & ``` ### Technical Analysis The default bind address is `0.0.0.0`, which causes vLLM to listen on every available network interface rather than only the loopback interface. The constructed server command does not configure an API key, authentication layer, TLS, or any client access restriction. Consequently, the documented `start` operation creates an OpenAI-compatible HTTP API that may be reachable by other systems on the local network and, depending on firewall and routing configuration, by external systems. This behavior conflicts with the documentation's characterization of the model as being served locally. The exposure does not require command injection or code execution within the shell script. An attacker only needs network connectivity to the configured port and can interact directly with vLLM's API. ### Attack Path 1. A user invokes the documented model start command without specifying a safer bind address. 2. `DEFAULT_HOST` resolves to `0.0.0.0`. 3. The script launches vLLM with `--host 0.0. ...[truncated 918 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
tool/modelready.sh:77
Finding

Unrestricted cleartext transmission of chat content to a configurable host

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares operational capabilities via metadata requirements and documented behavior that imply shell execution, environment-variable use, and network access, but it does not constrain those capabilities with an explicit tool scope such as permissions or allowed-tools. In an agent setting, that increases the chance the skill can invoke broader-than-necessary actions, including launching services and making networked requests, without clear policy boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation instructs users to start a model server, set host/port, and expose an OpenAI-compatible endpoint, but it does not warn that this alters local system and network state or may bind a service reachable by other processes or hosts. In practice, users may unintentionally expose an inference endpoint, consume significant local resources, or interact with untrusted model artifacts without understanding the security implications.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script persists a default bind host and defaults to 0.0.0.0, which exposes the vLLM API on all network interfaces rather than localhost only. In the context of a chat helper skill, this broadens attack surface and can unintentionally make a local model service reachable by other hosts on the network.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · tool/modelready.sh (reported line 193)May include surrounding context.

sh
fi

  # start server
  nohup python3 -m vllm.entrypoints.openai.api_server \
    "${ARGS[@]}" \
    >"$LOG_FILE" 2>&1 &

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script prints the final model response with a fixed Chinese prefix (你的模型说：), which imposes a specific language regardless of the user's locale or preferences. This is a natural-language policy issue because the skill does not offer any language selection or document a justified locale constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file says to use the skill to 'start using a local or Hugging Face model instantly' and 'test or interact with a model directly from chat' without defining narrower trigger phrases, exclusions, or negative examples. The invocation scope is broad enough that many generic model-related requests could match, increasing the chance of unintended activation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.