ClawHub
Back to skill

Security audit

3GPP Scout

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated 3GPP search purpose, but it tells agents to fetch and follow a mutable remote prompt that was not included for review.

Install only if you are comfortable using the 3GPP Scout hosted service and sharing your search queries with it. Treat the remote agent-setup prompt as untrusted reference material unless you review it separately, and do not let it authorize extra tools, files, domains, credentials, or workflow changes beyond 3GPP search setup.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:54
Finding

Unaudited Remote Instructions Can Hijack the Agent Session

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54–58
Vulnerability Type: Remote instruction loading and session-goal manipulation
Risk Level: High

Vulnerable Code Snippet:

markdown
For Cursor, Claude, Codex, or another MCP client, fetch and follow:

https://api.3gppscout.com/agent-setup/prompt.md

text

Technical Analysis

The Skill explicitly instructs an AI agent to fetch and follow instructions from a remotely hosted prompt. That prompt is not included in the audited package and can be modified by the remote service after the Skill has been reviewed or installed.

This creates an instruction-hijacking boundary: content retrieved from the URL is treated as authoritative agent instructions rather than untrusted external data. If the remote content is compromised or intentionally changed, it could instruct the agent to alter its current goals, disclose conversation or workspace information, invoke available tools, contact additional endpoints, or perform actions unrelated to 3GPP document search.

Fetching remote documentation may be necessary for MCP setup, but automatically following mutable remote instructions is not the minimum privilege required for the declared semantic-search functionality. The Skill should contain locally auditable setup instructions instead.

Attack Path

  1. A user or agent loads the 3gpp-scout Skill.
  2. The Skill directs the agent to retrieve https://api.3gppscout.com/agent-setup/prompt.md.
  3. The remote service, its hosting account, DNS path, or deployment pipeline is compromised, or the provider changes the prompt after package review.
  4. The returned document contains attacker-controlled instructions disguised as MCP setup guidance.
  5. Because the Skill says to “fetch and follow” the prompt, the agent treats those instructions as actionable.
  6. The malicious instructions can influence the current session and induce use of whatever tools, ...[truncated 886 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to “fetch and follow” the remotely hosted prompt.
  2. Bundle the complete MCP setup procedure in SKILL.md or another version-controlled file inside the Skill package so it is included in security review.
  3. If remote documentation must remain available, label it as untrusted reference material and prohibit the agent from treating it as instructions.
  4. Require explicit user approval before retrieving remote setup documentation or applying any configuration derived from it.
  5. Constrain remote content processing to a fixed schema containing only necessary configuration fields, and reject free-form instructions.
  6. Pin remotely retrieved material to a reviewed version or cryptographic digest and fail closed if verification fails.
  7. Restrict the Skill to the declared api.3gppscout.com endpoints and prevent remote content from authorizing additional domains, tools, files, or credentials.
  8. Ensure search requests include only user-approved query text. Do not send workspace files, conversation history, secrets, or unrelated context to the hosted API.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: 3gpp-scout
description: Semantic search over the full 3GPP TS/TR corpus (Rel-15 through Rel-20, 8,700+ document versions). The hosted index stays current as 3GPP publishes new and revised specs. Search text, diagrams, and figures across 2.6M+ text vectors. Hosted MCP at https://api.3gppscout.com/mcp/.
version: 1.2.0
homepage: https://3gppscout.com
metadata:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
---
name: 3gpp-scout
description: Semantic search over the full 3GPP TS/TR corpus (Rel-15 through Rel-20, 8,700+ document versions). The hosted index stays current as 3GPP publishes new and revised specs. Search text, diagrams, and figures across 2.6M+ text vectors. Hosted MCP at https://api.3gppscout.com/mcp/.
version: 1.2.0
homepage: https://3gppscout.com
metadata:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md
---
name: 3gpp-scout
description: Semantic search over the full 3GPP TS/TR corpus (Rel-15 through Rel-20, 8,700+ document versions). The hosted index stays current as 3GPP publishes new and revised specs. Search text, diagrams, and figures across 2.6M+ text vectors. Hosted MCP at https://api.3gppscout.com/mcp/.
version: 1.2.0
homepage: https://3gppscout.com
metadata:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

md
---
name: 3gpp-scout
description: Semantic search over the full 3GPP TS/TR corpus (Rel-15 through Rel-20, 8,700+ document versions). The hosted index stays current as 3GPP publishes new and revised specs. Search text, diagrams, and figures across 2.6M+ text vectors. Hosted MCP at https://api.3gppscout.com/mcp/.
version: 1.2.0
homepage: https://3gppscout.com
metadata:

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

How to get an API key:

  1. Sign up or log in at dashboard.3gppscout.com
  2. Go to the API Keys page
  3. Create a new key — it will start with sk-

Set your API key via environment variable:

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

The skill instructs the agent/client to fetch and follow a remote prompt from https://api.3gppscout.com/agent-setup/prompt.md. Pulling executable guidance or prompts from a mutable external source creates a prompt-supply-chain risk: the remote content can later change to include unsafe instructions, secret-harvesting guidance, or workflow overrides not visible in the reviewed skill file.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

For Cursor, Claude, Codex, or another MCP client, fetch and follow:

text
https://api.3gppscout.com/agent-setup/prompt.md

The hosted Streamable HTTP MCP URL is:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:52