ClawHub
Back to skill

Security audit

Apartment Cleaning

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent booking assistant, but it documents an unauthenticated status lookup that can reveal a customer's home address and appointment schedule from only an email address.

Review before installing. The booking flow is disclosed and requires confirmation before reserving a slot, but the status-check design is weak: someone with an email address may be able to retrieve sensitive booking details. Only use this skill if you trust the claw.cleaning service with customer contact details, home addresses, and schedules, and prefer not to use the status lookup unless the requester is clearly the customer.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:23
Finding

Unauthenticated Booking Status Endpoint Exposes Customer Addresses and Schedules

Content
View full analysis
` if the customer asks whether their booking went through. Returns upcoming bookings for that email. ``` `references/booking-flow.md:98-116`: ```markdown HTTP request: ``` GET https://claw.cleaning/bookings/status?email=jane%40example.com ``` Response (`200 OK`): ```json { "email": "jane@example.com", "bookings": [ { "date": "2026-04-18", "startTime": "10:00", "hours": 3, "address": "456 Castro St, San Francisco, CA 94114", "eventId": "..." } ] } ``` ``` ### Technical Analysis The documentation explicitly states that every API endpoint is public and requires no authentication. The booking-status endpoint uses only an email address supplied in a URL query parameter as the lookup key. An email address is an identifier, not an authentication factor, and possession of it does not prove that the requester owns the corresponding booking. The documented response discloses sensitive, identity-linked information, i ...[truncated 2522 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/booking-flow.md (reported line 171)May include surrounding context.

sh
# Upcoming availability (next 14 bookable days)
curl https://claw.cleaning/availability

# One specific day (before 2026-05-05, must be Saturday or Sunday)
curl "https://claw.cleaning/availability?date=2026-04-18"

Static analysis

No suspicious patterns detected.