ClawHub
Back to skill

Security audit

Feature Flags

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it advertises, but its remote flag polling can let any user-supplied endpoint silently change agent feature behavior without authentication or integrity checks.

Review before installing. Use this only with trusted local files and trusted HTTPS flag endpoints, and avoid letting untrusted users control --poll-url, --load, or --save values. Do not rely on it for sensitive or safety-critical agent controls unless you add endpoint authentication, response validation, and clear change logging.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill describes capabilities that imply file read/write and network access via a Python script, remote polling, local overrides, and export behavior, but it declares no corresponding permissions or warnings. This creates a transparency and governance gap: an agent or operator may enable a skill that can access local files and remote endpoints without clear approval boundaries.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The --save path is user-controlled and writes arbitrary files without path restrictions or safety checks. In an agent or service context, if an attacker can influence this argument they may overwrite application files, drop configuration content, or abuse the process's filesystem permissions for unintended side effects.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly promotes remote polling of an HTTP endpoint and context-based evaluation using user/org data, but it provides no warning that network access occurs or that contextual identifiers may be transmitted to a remote service. In an agent environment, this can lead to unreviewed outbound requests, metadata leakage, or insecure transport if users copy the example HTTP configuration as-is.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The polling thread fetches JSON from an arbitrary URL and immediately applies it to runtime state with no authentication, integrity verification, origin allowlist, or user disclosure. This creates a remote configuration injection channel: anyone controlling the endpoint, DNS, or traffic path can silently change feature behavior, potentially enabling dangerous features such as debug-mode or other gated functionality.

Static analysis

No suspicious patterns detected.