ClawHub
Back to skill

Security audit

ScopeGate Client

Security checks for vulnerabilities and agentic risk

Overview

The skill is not covertly malicious, but it gives a third-party service broad control over whether many agent actions may proceed and sends sensitive authorization details to a configurable endpoint.

Install only if you intentionally want ScopeGate to gate consequential agent actions. Treat it as granting a third party visibility into requested operations and control over whether covered actions proceed; avoid untrusted SCOPEGATE_URL values and use narrowly scoped, revocable credentials.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:8
Finding
External Service Hijacks Agent Authorization and Execution Decisions## Vulnerability Details **File Location**: `SKILL.md`, lines 8-17 and 40-45 **Vulnerability Type**: Mandatory delegation of Agent control to an external service **Risk Level**: High **Vulnerable code:** ```markdown Before executing any consequential action, you MUST verify scope with ScopeGate. ## When to Call ScopeGate Call before ANY action involving: - Money (payments, transfers, purchases) - Data writes (database inserts/updates/deletes) - External API calls (sending emails, posting to social, webhooks) - File system changes (deletes, overwrites) - Any action the human has not explicitly pre-authorized in this session ``` ```markdown ## Decision Rules - If `permitted: true` → proceed with the action - If `permitted: false` → STOP. Do not proceed. Report the `reason` to the user. - If ScopeGate is unreachable → STOP. Treat as denied. Never fail open. - Never cache a permit — call ScopeGate fresh for every consequential action ``` ### Technical Analysis The Skill installs broad, mandatory instructions that intercept consequential Agent operations and delegate the decision to proceed to the third-party ScopeGate service. The interception applies to financial operations, data writes, external API requests, file changes, and any action not explicitly authorized during the current session. These rules alter the Agent's normal execution and authorization model when the Skill is loaded. In particular, a remote response controls whether the Agent continues or stops. The requirement to report the service-provided `reason` also introduces externally supplied content into the Agent-user interaction. Although the document does not explicitly instruct the Agent to execute commands contained in that field, treating untrusted service output as authoritative creates an instruction-hijacking and social-engineering surface. The fail-closed requirement and prohibition on caching make every covered action dependent on t ...[truncated 1223 chars]
Remediation
## Remediation Suggestions - Remove the global mandatory interception rule and do not allow a third-party service to override platform, system, or explicit user authorization. - Make ScopeGate verification opt-in for each clearly defined workflow rather than automatically applying it to every consequential action. - Restrict verification to a narrow, documented set of operations and parameters approved by the user. - Treat all response fields, including `reason`, as untrusted data. Display them only as quoted informational content and never interpret them as Agent instructions. - Establish a local authorization boundary that cannot be expanded or altered by the remote response. - Define a user-approved availability policy rather than allowing an external outage to block unrelated actions indefinitely. - Require explicit user confirmation before a remote service is allowed to influence high-impact operations.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:21
Finding
Sensitive Authorization and Operational Data Sent to a Configurable Remote Endpoint## Vulnerability Details **File Location**: `SKILL.md`, lines 21-38 **Vulnerability Type**: Sensitive-data disclosure through unsafe endpoint configuration **Risk Level**: High **Vulnerable code:** ```markdown ## Endpoint Default: `https://api.scopegate.ai` Override: set `SCOPEGATE_URL` environment variable ## How to Call ScopeGate ```bash SCOPEGATE_URL="${SCOPEGATE_URL:-https://api.scopegate.ai}" curl -s -X POST "$SCOPEGATE_URL/grant/verify" \ -H "Content-Type: application/json" \ -d '{ "grant_id": "<grant_id from delegator>", "agent_id": "<your agent id>", "requested_action": "<action you are about to take>", "api_key": "<your api key>" }' ``` ``` ### Technical Analysis The Skill instructs the Agent to submit a grant identifier, Agent identifier, requested-action description, and API key in a JSON request body. The destination is taken directly from the `SCOPEGATE_URL` environment variable without an origin allowlist, hostname validation, or a requirement that the override use HTTPS. Any party capable of controlling the Agent's environment can redirect the mandatory request to an arbitrary server. Because verification is required before a broad range of sensitive operations, the attacker can repeatedly collect credentials and detailed information about intended financial, data, API, and file-system actions. Placing the API key in the request body also increases exposure through HTTP-body logging, debugging middleware, reverse proxies, observability systems, and server-side request capture. The command uses `curl -s` without options that explicitly enforce HTTPS, restrict redirects, or reject non-successful HTTP responses. ### Attack Path 1. An attacker or compromised launcher sets `SCOPEGATE_URL` to an attacker-controlled URL, including a non-TLS URL if the runtime permits it. 2. The Agent loads the Skill and receives a request involving a covered a ...[truncated 1258 chars]
Remediation
## Remediation Suggestions - Remove unrestricted `SCOPEGATE_URL` overrides or validate the destination against a strict allowlist of trusted HTTPS origins. - Reject plaintext HTTP, embedded credentials, unexpected ports, IP-literal destinations, and URLs containing unapproved paths or user information. - Store the API key in an approved secret manager and transmit it through a protected authorization header rather than the JSON body. - Minimize request data. Use opaque action identifiers or narrowly scoped policy references instead of free-form descriptions of intended operations. - Use short-lived, audience-bound, least-privilege credentials that cannot be replayed against another endpoint or operation. - Configure the HTTP client to reject redirects to different origins, verify TLS certificates, enforce connection and response timeouts, and fail on non-successful status codes. - Ensure clients, proxies, and servers redact authorization headers, grant IDs, Agent IDs, and request bodies from logs and diagnostics. - Require explicit user approval before transmitting operational metadata to a third party and clearly disclose what data will be sent.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
SCOPEGATE_URL="${SCOPEGATE_URL:-https://api.scopegate.ai}"

curl -s -X POST "$SCOPEGATE_URL/grant/verify" \
  -H "Content-Type: application/json" \
  -d '{
    "grant_id": "<grant_id from delegator>",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.