ClawHub
Back to skill

Security audit

Feature Toggle Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward feature-flag audit and cleanup guide, with some external API and deletion-related examples users should approve carefully.

Use this skill for feature-flag audits and planning, but do not let an agent remove flags, edit service configuration, or query third-party APIs without explicit approval. Prefer read-only or least-privilege API keys, review the generated cleanup plan, and run changes through normal code review and staging validation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Script Fetching

High
Category
Supply Chain
Content
"

# Unleash API: list all toggles
curl -s -H "Authorization: $UNLEASH_API_TOKEN" \
  "$UNLEASH_URL/api/admin/features" | python3 -c "
import sys, json
data = json.load(sys.stdin)
Confidence
90% confidence
Finding
The skill pipes data fetched from a remote Unleash endpoint directly into an inline Python interpreter for processing. Although the current script parses JSON rather than executing fetched code, this pattern normalizes remote-to-interpreter pipelines and increases risk from malicious endpoints, malformed responses, or unsafe future modifications.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs the agent to call LaunchDarkly and Unleash APIs using service credentials and repository-derived flag identifiers, but it provides no warning, consent step, or data-minimization guidance before sending context externally. In an agent setting, this can cause unintended disclosure of internal project names, feature identifiers, environment structure, or other sensitive operational metadata to third-party services.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The cleanup workflow includes removal actions such as deleting flag evaluations, collapsing branches, removing service configuration, and deleting environment-variable definitions, but it does not clearly warn that these are potentially destructive changes. An agent following this guidance could remove operational kill switches, rollout controls, or entitlement checks without sufficient human review.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Verify metrics exist for the flag (Datadog example)
curl -s "https://api.datadoghq.com/api/v1/query?query=avg:app.feature_flag.evaluation{flag_name:new-checkout-flow}" \
  -H "DD-API-KEY: $DD_API_KEY" -H "DD-APPLICATION-KEY: $DD_APP_KEY"

# Check error rates segmented by flag state (Prometheus/Grafana)
Confidence
88% confidence
Finding
The Datadog API example sends flag names and monitoring queries to an external service using API credentials, again without any warning about external transmission. Even if the transmitted value seems limited, feature names and observability metadata can expose internal roadmap, product experiments, or incident-related details.

Static analysis

No suspicious patterns detected.