ClawHub
Back to skill

Security audit

band-fpx

Security checks for vulnerabilities and agentic risk

Overview

The skill is marked suspicious because a scanner reports that its API destination can be overridden while BAND session cookies are sent, creating a risk of credential exposure; the scan was also partial.

Consider the reported credential exposure risk before installing. The scan inspected 2 of 3 components and was partial, so its evidence is incomplete; the overall verdict is suspicious, not a finding of malicious intent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

An unrestricted API-base override allows BAND session cookies to be sent to a non-BAND server.

High
Category
Excessive Agency
Confidence
99% confidence
Finding

BAND_API_BASE accepts an arbitrary destination, and the request attaches the user's BAND session cookies without validating that destination. An attacker who can influence the invocation environment can direct these credentials to an attacker-controlled server, potentially enabling session hijacking; this is especially sensitive because the helper extracts credentials from an authenticated browser session.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, network.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

API requests force English without user language selection or opt-in.

Low
Category
Output Handling
Confidence
92% confidence
Finding

The request headers unconditionally set language: 'en', imposing English on language-sensitive API responses regardless of the user's preference. The file provides neither a language-selection mechanism nor a documented justification for this locale constraint.

Content

No source excerpt is available for this finding.