ClawHub
Back to skill

Security audit

Html Report

Security checks for vulnerabilities and agentic risk

Overview

The skill’s dashboard purpose is coherent, but it generates a browser-opened report from private tracker data with under-specified HTML safety and an unpinned external JavaScript dependency.

Review before installing. The skill is not trying to modify your tracker, but reports may contain all tracked application details and run browser JavaScript. Prefer a version that escapes every database field, validates links with an explicit http/https allowlist, and pins or bundles Chart.js with integrity protection.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:187
Finding

Stored HTML and JavaScript Injection in Generated Dashboard

Content
View full analysis
block (palette, cards, charts grid, table) - stat cards row - two 2-column chart rows (doughnut, tags bar / by-month bar, funnel bar) - filterable table (search input + status/company dropdowns, client-side JS) ... - `link` column renders as a hyperlink (`target="_blank" rel="noopener"`) if present; otherwise `—`. ... `Date` (`applied_on`) · `Company` · `Role` · `Status` · `Next action` · `Tags` · `Interview date` · `Notes` (truncate to 80 chars, full text in a `title` tooltip) · `Link` (hyperlink or `—`) ``` ### Technical Analysis The skill instructs the agent to read tracker-controlled database fields and interpolate them into a self-contained HTML document. These values are used in several distinct output contexts: - HTML text nodes, such as company, role, tags, and notes - HTML attributes, including the notes `title` tooltip - Hyperlink attributes generated from the `link` field - Inline client-side JavaScript or chart data The specification does not require context-sensitive output encoding or safe DOM construction. Generic replacement is insufficient because HTML text, HTML attributes, URLs, and inline JavaScript each require different handling. For example, a malicious tracker value containing HTML such as an image element with an event handler could execute if inserted using `innerHTML ...[truncated 1896 chars]
Remediation
View remediation
` or place the data in a non-executable JSON element and parse it safely. 4. Parse links with the browser `URL` API and allow only explicit `https:` and, if necessary, `http:` protocols. Reject malformed URLs and all other protocols. Do not rely on a case-sensitive `startsWith("http")` check. 5. Add a restrictive Content Security Policy that blocks inline event handlers and limits outbound connections. Prefer external or nonce-authorized local scripts instead of unrestricted inline JavaScript. 6. Add regression tests using payloads in every rendered field, including: - HTML elements with event handlers - Quotes that escape attributes - `` sequences - Mixed-case and malformed URL schemes - Unicode and encoded delimiter variants ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:216
Finding

Unpinned Chart.js Runtime Dependency Loaded from a CDN

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger list contains generic phrases like "build me a dashboard," "show me a chart," "make a report I can send," and "refresh the dashboard." In a markdown skill description, these broad phrases overlap with common requests and the file does not provide exclusion conditions or negative examples to narrow when this specific skill should activate.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md
STEP 1  Parse arguments
  IF path argument given: output_path = that path
  ELSE: output_path = "reports/application-dashboard.html"
  mkdir -p dirname(output_path)

STEP 2  Collect data
  columns = sqlite3 DB_PATH "PRAGMA table_info(applications);"

Static analysis

No suspicious patterns detected.