ClawHub
Back to skill

Security audit

Privacy Concierge

Security checks for vulnerabilities and agentic risk

Overview

This privacy concierge is mostly aligned with its stated purpose, but it includes an undeclared unrestricted local file read tool and under-discloses sensitive personal-data flows.

Review this skill carefully before installing. It is designed to handle very sensitive personal information and may send opt-out or deletion requests externally. Do not enable it unless the local file read tool is removed or strictly sandboxed, and unless the skill adds explicit consent, review, retention, and deletion controls for PII and outbound actions.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
tools/read.js:3
Finding

Unrestricted Local File Read Through Caller-Controlled Path

Content
View full analysis

Vulnerability Details

File Location: tools/read.js:3-6
Vulnerability Type: Arbitrary local file read caused by missing path validation and authorization
Risk Level: High

Vulnerable Code

js
module.exports = async function readFile(context, params) {
  try {
    const content = fs.readFileSync(params.path, 'utf8');
    return content;

Technical Analysis

The tool passes the caller-controlled params.path directly to fs.readFileSync without validating, canonicalizing, or restricting the requested path. It does not confine reads to a designated workspace or an allowlist of user-owned files.

The context argument is unused, so the function performs no caller authorization or ownership check. Absolute paths, parent-directory traversal, symbolic-link escapes, sensitive virtual files such as /proc/self/environ, and credential files are not explicitly rejected.

Consequently, anyone able to invoke the tool or influence its arguments can attempt to read any UTF-8-compatible file accessible under the operating-system permissions of the Agent process. This also contradicts the claim in SKILL.md:29 that tools are sanitized and limited to user-owned data.

Attack Path

  1. An attacker directly invokes the read tool or uses prompt injection to influence an Agent that can invoke it.
  2. The attacker supplies a sensitive path through params.path, such as /proc/self/environ, an application .env file, or a private-key path.
  3. The function passes that path unchanged to fs.readFileSync.
  4. Node.js reads the target using the operating-system privileges of the Agent process.
  5. The function returns the complete file contents to the Agent or caller.
  6. The sensitive content may then be disclosed in an Agent response or passed to another available tool.

Impact Assessment

Exploitation grants read access to files available to the runtime account, rather than only files legitimately r ...[truncated 533 chars]

Remediation
View remediation

Remediation Suggestions

  1. Define a dedicated, least-privilege directory from which the tool is permitted to read.
  2. Reject absolute paths and requests containing parent-directory traversal.
  3. Resolve the requested path against the permitted root and canonicalize both paths with fs.realpath.
  4. Verify that the canonical target remains inside the canonical permitted root, using a separator-aware containment check.
  5. Reject symbolic links or verify their fully resolved targets before reading.
  6. Enforce caller identity, file ownership, and authorization using the supplied context.
  7. Block sensitive files and virtual or device paths, including environment files, private keys, /proc, and /dev.
  8. Apply file-type and maximum-size limits to reduce secret exposure and denial-of-service risk.
  9. Return generic errors rather than exposing internal paths or detailed filesystem errors.
  10. Run the Agent under a dedicated operating-system account with minimal filesystem access.
  11. Add security tests covering absolute paths, ../ traversal, encoded traversal, symbolic-link escapes, /proc/self/environ, credential files, oversized files, and unauthorized callers.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Automated opt-out requests and scans inherently involve sending user identifiers to outside parties and performing account- or reputation-impacting actions, yet the description lacks a clear warning about those consequences. Because the skill is specifically designed to handle privacy remediation, the context makes undisclosed external transmission and automation more dangerous, not less, since users are likely to submit highly sensitive PII.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill describes persistent memory for user PII and proactive outbound notifications, but does not provide a clear warning that it stores, processes, and may act on sensitive personal data over time. In a privacy-focused skill, this omission is especially risky because users may disclose addresses, emails, phone numbers, or identity details without understanding the retention and automation implications.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The statement that sensitive PII is only logged in Supabase conflicts with the described use of external tooling such as web search, email sending, and LLM inference, all of which may transmit or expose PII outside Supabase. This is dangerous because it understates the actual privacy boundary and can lead users or integrators to mishandle highly sensitive data under false assumptions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill claims there is no external sharing without explicit consent, but its documented behavior includes automated opt-out emails, web searches, and proactive messaging. That creates a misleading security assurance: users may provide sensitive personal data believing it will remain internal when the skill is designed to transmit data to third parties as part of its operation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.