ClawHub
Back to skill

Security audit

Orion Ads

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent OrionAds search/advertising integration, but its shell-command examples create a realistic command-injection risk if an agent substitutes user queries into them.

Install only if you are comfortable sending queries and optional account or ad data to OrionAds. Agents should not paste user-controlled queries into shell command strings from this skill; they should call curl with an argument array or otherwise pass query values without shell interpretation, and only post ads or use ORION_API_KEY when explicitly directed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:21
Finding

Shell Command Injection Through Unsafe Search Query Interpolation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21–24
Vulnerability Type: Shell command injection caused by unsafe interpolation into a shell command
Risk Level: High

Vulnerable Code

bash
# Syntax - Safe encoding protects against injection
curl -G "https://orionads.net/api/v1/search" \
    --data-urlencode "q=<query> product price buy"

Equivalent unsafe patterns are also documented at SKILL.md:53–56 for general search.

Technical Analysis

The documentation instructs an agent to substitute a user-controlled query into a double-quoted shell argument. Although curl --data-urlencode safely URL-encodes the resulting argument for HTTP transport, it does not protect the command during shell parsing.

If raw user input is inserted into the command text before execution, shell expansions contained in that input—such as $(command) or backtick command substitution—are evaluated locally before curl runs. Consequently, the statement that URL encoding protects this construction against shell injection is incorrect.

Exploitation depends on an implementation generating shell command text by replacing the documented placeholder with untrusted input. Implementations that launch curl directly with a properly separated argument array are not affected.

Attack Path

  1. An attacker supplies a product or general-search query containing a shell substitution expression.
  2. An agent replaces <query> in the documented command with the untrusted value.
  3. The agent submits the resulting command text to a shell.
  4. The shell evaluates command substitutions and related expansions before starting curl.
  5. The injected local command executes with the operating-system privileges of the agent process.
  6. Only after that execution does curl URL-encode and transmit the resulting search argument.

Impact Assessment

Successful exploitation permits arbitrary local command execu ...[truncated 415 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not generate shell source by substituting user-controlled text into command templates.
  • Launch curl through a process API that accepts an argument array, ensuring the complete query is passed as one argument without invoking a shell.
  • If a shell cannot be avoided, provide the query through a positional parameter or environment variable established outside dynamically generated shell text, and expand it only as a quoted value.
  • Validate query length and reject control characters as defense-in-depth, while recognizing that validation is not a substitute for avoiding shell interpretation.
  • Revise all affected search examples, including the analogous patterns at SKILL.md:53–56.
  • Add tests using inputs containing command substitutions, backticks, quotes, semicolons, newlines, and option-like prefixes to verify that no local command is executed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
## Security & Sanitization 🛡️
**CRITICAL:** When constructing shell commands, YOU MUST prevent shell injection vulnerabilities.
1.  **Never** inject raw user input directly into shell strings.
2.  **GET Requests:** ALWAYS use `curl --data-urlencode "q=<user_input>"` instead of putting the query directly in the URL string.
3.  **POST Requests:** Escape all single quotes `'` in the JSON payload, or write the JSON to a temporary file (`payload.json`) and use `curl -d @payload.json`.

## Tools

Static analysis

No suspicious patterns detected.