T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:19- Finding
Unpinned Third-Party Package Is Retrieved and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawhub Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill is openly for remote agent diagnosis and repair, but it asks users to run mutable external code that sends broad local health data and automatically performs potentially destructive repairs.
Only install this after confirming you trust the Agent Hospital publisher and service. Run it with least privileges, avoid production or sensitive agent environments until there is a dry-run or approval mode, verify exactly what telemetry is uploaded, and check how cached credentials can be protected and revoked.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:25- Finding
Broad Local Health Data Is Collected and Transmitted Without Defined Boundaries
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:29- Finding
Remote Diagnoses Can Trigger Destructive Local Repairs Automatically
- Content
View full analysis
50MB) ### Hermes - `restart-gateway` -- Restart the Hermes gateway - `prune-sessions` -- Delete sessions older than 30 days - `checkpoint-wal` -- Checkpoint SQLite WAL file - `kill-port-conflict` -- Kill processes blocking port 8642 - `clean-logs` -- Delete log files older than 7 days ``` ### Technical Analysis The Skill states that diagnoses are obtained from an external service and that prescribed repairs are executed automatically. The available actions can restart services, kill processes, delete sessions, delete logs, truncate files, and modify SQLite state. These are privileged and potentially destructive operations. The project does not include the sidecar implementation, repair whitelist, parameter validation, path restrictions, process-ownership checks, authentication protocol, or rollback mechanism. The assertion that repairs are “safe” therefore cannot be independently verified. The repeated diagnose-repair-report loop increases the potential impact of an incorrect, compromised, or manipulated diagnosis. A single bad decision could be followed by further destructive actions before a user intervenes. ### Attack Path 1. The sidecar sends health data to the remote diagnosis service. 2. The remote service selects or prescribes a r ...[truncated 1026 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:33- Finding
Persistent Credential Cache Has No Documented Security Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The skill states that credentials are cached in
~/.agent-hospital/credentials.json, indicating creation of reusable local authentication material. Storing credentials on disk is not inherently unsafe, but without any mention of file permissions, encryption, rotation, or token scope, it creates credential exposure risk if the host is multi-user, compromised, or backups/logs are accessible.- Content
md 5. Execute safe (whitelisted) repairs automatically 6. Report results back and repeat until healed or escalated No setup, API keys, or configuration needed. Credentials are cached at `~/.agent-hospital/credentials.json` for future runs. ## Supported Frameworks
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md requires: bins: [npx] primaryEnv: "" homepage: https://api.agent-hospital.ai/.well-known/llms.txt --- # Agent Hospital
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md requires: bins: [npx] primaryEnv: "" homepage: https://api.agent-hospital.ai/.well-known/llms.txt --- # Agent Hospital
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The skill instructs users to run
npx @agent-hospital/sidecar healwithout pinning an exact package version, which allows the executed code to change over time and expands supply-chain risk. Because this command is meant to collect local health data and perform repairs automatically, a compromised or newly published version could gain broad visibility into the host and make destructive changes.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says the tool will collect health data and send it to a remote doctor service, but it does not present a clear, prominent warning about the scope of exfiltrated local environment, integration, runtime, and log-derived data. In this context, hidden or underexplained transmission is dangerous because the skill targets production-like agent environments and may disclose sensitive operational metadata or secrets-adjacent information to an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill advertises automatic execution of repairs while only later listing actions that include deleting files and killing processes, without a strong up-front destructive-action warning. This is dangerous because users may run the command expecting diagnostics only, while the sidecar can mutate system state, terminate services, or remove data in ways that affect availability and forensic evidence.
- Content