ClawHub
Back to skill

Security audit

honeybook

Security checks for vulnerabilities and agentic risk

Overview

This HoneyBook skill handles sensitive portal data and cached credentials, but the access and user-confirmed actions are disclosed and fit the stated purpose.

Install only if you intend to connect HoneyBook portal sessions. Treat pasted magic links and flow links as credentials, review previews before sending messages, use confirm:true only after checking the action, and ask the agent to clarify when a request like paying an invoice or replying to a vendor might refer to another service.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger description is overly broad and includes generic actions like 'sign contract', 'pay invoice', 'message the planner', and 'reply to my vendor' without requiring an explicit HoneyBook context. That can cause the agent to invoke this skill for unrelated user requests, unnecessarily exposing HoneyBook portal capabilities and data access paths when the user did not intend to use this integration.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Only **two** tools here take the fleet's `view` parameter: `get_project` and
`get_flow`. Both honour `compact | raw`, and **`compact` is the default** — you
get the cheap shape without asking for it. There is no `full` rung on either:
`raw` already IS every field HoneyBook sent, so a third value would silently
alias to one of the other two.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.