ClawHub
Back to skill

Security audit

onehome-fpx

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its OneHome search purpose, but its login instructions leave account-access tokens in predictable temporary files without protection or cleanup.

Review the credential handling before use: keep login tokens in memory or use a private temporary directory with restrictive permissions and cleanup, and avoid printing tokens into logs. Approve browser access only for OneHome. The supplied static scan reported no findings, but direct inspection established the credential concern; external CLI and extension behavior remains unverified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

The authentication workflow saves sensitive tokens to temporary files without warning about credential persistence.

Medium
Category
Output Handling
Confidence
98% confidence
Finding

The workflow writes the magic-link email token to /tmp/checktoken-body.json and the authentication response, including sessionToken and personal information, to /tmp/checktoken.json without restricting permissions or removing the files afterward. Depending on the user's umask and host configuration, other local users or processes could read these credentials and reuse them to access the consumer's OneHome data; predictable filenames also create potential symlink and overwrite risks. Authentication is legitimate for this skill, but persisting reusable credentials unnecessarily increases exposure.

Content

No source excerpt is available for this finding.