ClawHub
Back to skill

Security audit

alltrails-fpx

Security checks for vulnerabilities and agentic risk

Overview

This skill provides read-only AllTrails access through your browser, with disclosed permissions and a temporary-file handling weakness.

Approve only the AllTrails domain and the documented header capture, and remember that the agent can read account information available through your signed-in tab. Replace fixed temporary files with private, uniquely created files and delete them afterward; the fallback does store output despite the no-storage claim. Locale defaults and explicitly public-profile reads do not justify escalation. Both bundled documents were reviewed, resolving the scanner's local-reference gaps; external dependency binaries and live API behavior remain unverified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

The capture fallback writes the app key to disk despite the explicit claim that it is not stored anywhere.

Low
Category
Excessive Agency
Confidence
93% confidence
Finding

The fallback persists session output at the predictable path /tmp/at.json without explicit permission restrictions or cleanup, contradicting the no-storage claim. On shared systems, this can expose output under permissive permissions or allow a pre-created symlink to redirect the write, although the documented anonymous app key alone is not an account credential.

Content

No source excerpt is available for this finding.

The skill mandates an en-US locale for API requests without user opt-in.

Low
Category
Output Handling
Confidence
90% confidence
Finding

The instructions require attaching the protocol headers on every call and hard-code x-language-locale: en-US, selecting a specific language and locale for localized API content. Matching the MCP defaults does not justify this locale restriction, and the skill provides no user choice.

Content

No source excerpt is available for this finding.

The shared request headers hard-code the en-US locale without user choice or a documented justification.

Low
Category
Output Handling
Confidence
94% confidence
Finding

The shared header configuration sets x-language-locale: en-US for the endpoint examples, imposing a specific locale on API requests. The file neither offers a locale choice nor explains why US English is required.

Content

No source excerpt is available for this finding.

User-specific queries extend beyond the signed-in user's data to other public profiles.

Low
Category
Excessive Agency
Confidence
88% confidence
Finding

The manifest describes saved lists, completed trails, and activity feeds for the signed-in user, but L090 explicitly allows another public profile's numeric ID. That ID is also reused for completed-trail and feed requests at L109 and L116–L120, extending the described user-data scope without implying any access-control bypass.

Content

No source excerpt is available for this finding.