ClawHub
Back to skill

Security audit

evite-api

Security checks for vulnerabilities and agentic risk

Overview

The Evite features fit their purpose, but session-file handling and unchecked photo-upload destinations warrant review before use.

Review the cookie-storage and photo-upload recipes before use. Use a uniquely created private session file, remove it afterward, and restrict upload and completion URLs to expected HTTPS destinations. Explicitly approve recipients, event changes and photos before sending or publishing. Both bundled files were inspected; live Evite behavior and publisher provenance remain unverified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

Photo uploading and shared-gallery publication are substantive capabilities not disclosed in the description's listed event, guest-list, RSVP, and messaging operations. The signed cloud-storage upload is a supporting part of that photo workflow, not independently evidence of unrelated exfiltration. The mismatch is the undeclared photo-sharing capability, rather than the use of curl, cookies, or Evite APIs.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
recipes) is in `references/endpoints.md`.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/endpoints.md (reported line 257)May include surrounding context.

Full object every time (guest_id selects, the rest are the new values) — this is a set, not a merge.

14. Remove a draft guest — DELETE /ajax/event/{id}/guestlist/draft/{guestId}

sh
CSRF=$(awk -F'\t' '$6=="csrftoken"{v=$7} END{print v}' "$JAR")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: evite-api
description: >-
  Query and act on Evite (evite.com) events, guest lists, RSVPs, and
  messages from a shell with curl and a cookie jar — instead of running
  the evite-mcp server. Does a headless EVITE_EMAIL/EVITE_PASSWORD login
  against evite.com's internal /services/, /ajax/, and /tsunami/ APIs, no
  browser or extension involved. Use when you want Evite data/actions

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

sh
CSRF=$(awk -F'\t' '$6=="csrftoken"{v=$7} END{print v}' "$JAR")
curl -sS -b "$JAR" -c "$JAR" -X PUT \
  -H 'Content-Type: application/json' -H "X-CSRFToken: $CSRF" \
  -d '{"rsvpResponse":"yes","numberOfAdults":2,"numberOfKids":0}' \
  "https://www.evite.com/services/event/v1/$EVENT_ID/guests/$GUEST_ID"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 118)May include surrounding context.

sh
CSRF=$(awk -F'\t' '$6=="csrftoken"{v=$7} END{print v}' "$JAR")
curl -sS -b "$JAR" -c "$JAR" -X PUT \
  -H 'Content-Type: application/json' -H "X-CSRFToken: $CSRF" \
  -d '{"rsvpResponse":"yes","numberOfAdults":2,"numberOfKids":0,"comments":"can'\''t wait!"}' \
  "https://www.evite.com/services/event/v1/$EVENT_ID/guests/$GUEST_ID"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 133)May include surrounding context.

sh
CSRF=$(awk -F'\t' '$6=="csrftoken"{v=$7} END{print v}' "$JAR")
curl -sS -b "$JAR" -c "$JAR" -X POST \
  -H 'Content-Type: application/json' -H "X-CSRFToken: $CSRF" \
  -d '{"message":"See you Saturday!"}' \
  "https://www.evite.com/tsunami/v1/services/event/$EVENT_ID/guest/$GUEST_ID/messages"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 181)May include surrounding context.

md
v=$(jq -r --arg k "$k" '.upload_form[$k]' <<<"$TICKET")
  FORM_ARGS+=(-F "$k=$v")
done
FINISH_URL=$(curl -sS -D - -o /dev/null "${FORM_ARGS[@]}" -F "file=@/path/to/photo.jpg" "$UPLOAD_URL" \
  | grep -i '^location:' | tr -d '\r' | awk '{print $2}')

# Step 3 — finalize the object into the album (best-effort; ignore failures).

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

The finalization request uses an externally supplied Location header as a URL without checking its scheme, host, or path. If that response is attacker-influenced, the agent can be induced to request an unintended endpoint, including an internal service; curl's cookie-domain rules limit arbitrary cross-domain cookie disclosure but do not prevent the unintended request.

Content

Scanner excerpt · references/endpoints.md (reported line 185)May include surrounding context.

md
| grep -i '^location:' | tr -d '\r' | awk '{print $2}')

# Step 3 — finalize the object into the album (best-effort; ignore failures).
curl -sS -b "$JAR" -c "$JAR" "$FINISH_URL" -o /dev/null

# Step 4 — register the photo in the event's shared gallery.
CSRF=$(awk -F'\t' '$6=="csrftoken"{v=$7} END{print v}' "$JAR")