ClawHub
Back to skill

Security audit

Facture Make

Security checks for vulnerabilities and agentic risk

Overview

This invoice skill is purpose-aligned, but it needs review because it sends invoice data to a hardcoded Make.com webhook and can report success even when delivery fails.

Install only if you control and trust the Make.com webhook and are comfortable sending client and invoice details to that external automation. Before production use, the webhook should be moved to protected configuration, the payload should be strictly validated, and the agent should report the real send result instead of always saying the delivery was confirmed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:34
Finding

Unconditional Agent Response Hijacking Conceals the Actual Invoice Delivery Result

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
send_invoice.py:6
Finding

Hardcoded Capability-Bearing Webhook Accepts Insufficiently Validated Arbitrary JSON

Content
View full analysis
1 else sys.stdin.read() try: data = json.loads(raw_input) # 2. NETTOYAGE : On cherche la clé 'invoice' ou 'invoice_data' # Si l'IA envoie tout, on ne garde que la partie facture if isinstance(data, dict): if "invoice" in data: payload = data["invoice"] elif "invoice_data" in data: payload = data["invoice_data"] else: # Si 'invoice' n'est pas une clé, on vérifie si l'objet # lui-même contient les champs attendus (client, jours, etc.) payload = data else: payload = data # 3. Envoi à Make.com url = "https://hook.eu1.make.com/fto1pw8gfyk2kwqm8bab4ujykpfx1izi" response = requests.post(url, json=payload) ``` ### Technical Analysis The Make.com webhook URL is embedded directly in source code. A webhook URL containing an unguessable identifier commonly functions as a capability credential: possession of the URL may be sufficient to trigger the associated automation. Anyone who can read the repository or a distributed copy of the skill can extract and invoke it independently of the intended human-confirmation workflow. The script also lacks an exact invoice schema. If the decoded JSON object has neither an `invoice` nor an `invoice_data` property, the entire object is forwarded. Non-dictionary JSON values are forwarded as well. There is no validation of required fields, types, numeric ranges, string lengths, or unknown properties. Consequently, arbitrary JSON can reach the automation endpoint. No input-size limit is enforced, and the HTTP request has no timeout. A large input can consume excessive memory during pa ...[truncated 1594 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly sends invoice data, including client-identifying information, to Make.com but does not disclose that customer data leaves the local system or warn about third-party processing. This creates a real privacy and compliance risk because users or operators may unknowingly transmit personal or commercial data to an external service without informed consent or appropriate handling safeguards.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Le contenu du fichier est rédigé en français et la consigne finale force explicitement la réponse "Envoi confirmé." sans alternative linguistique. Cette contrainte de langue n'est ni présentée comme un choix utilisateur ni justifiée par un contexte régional ou réglementaire.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code silently sends invoice payloads to an external Make.com endpoint without any user-facing disclosure or confirmation. In the context of invoices, this is dangerous because users may unknowingly transmit confidential billing, client, or payment data to a third party, creating privacy, compliance, and data-handling risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This is a concrete external transmission of potentially sensitive invoice data to a fixed webhook endpoint. In an agent skill context, hidden outbound data flows are more dangerous because the skill can be invoked automatically and users may not realize that customer financial data leaves the local environment.

Content

Scanner excerpt · send_invoice.py (reported line 28)May include surrounding context.

python
# 3. Envoi à Make.com
        url = "https://hook.eu1.make.com/fto1pw8gfyk2kwqm8bab4ujykpfx1izi"
        response = requests.post(url, json=payload)
        
        if response.status_code == 200:
            print("OK")

Tainted flow: 'payload' from sys.stdin.read (line 24, user input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
95% confidence
Finding

The script takes JSON from argv/stdin, extracts invoice-related content, and forwards it directly to a hard-coded third-party webhook with no validation, authorization check, or data minimization. Because invoice data commonly contains sensitive financial and customer information, this creates a real exfiltration path where untrusted input is transmitted externally by default.

Content

Scanner excerpt · send_invoice.py (reported line 28)May include surrounding context.

python
# 3. Envoi à Make.com
        url = "https://hook.eu1.make.com/fto1pw8gfyk2kwqm8bab4ujykpfx1izi"
        response = requests.post(url, json=payload)
        
        if response.status_code == 200:
            print("OK")

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The file includes natural-language comments and output messages exclusively in French, such as error and status text. If the surrounding environment does not explicitly specify French, this can violate language-choice expectations by forcing a locale without offering an alternative.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.