ClawHub
Back to skill

Security audit

wish-research

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Wish research integration, but its helper can make broader authenticated Crawlora requests than the documented read-only endpoints require.

Install only if you are comfortable giving the skill access to a Crawlora API key and sending Wish research queries to Crawlora. Review the helper before use because it currently permits authenticated POST requests that go beyond the documented read-only Wish endpoints.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/crawlora.sh:48
Finding
Overly Broad Route and HTTP Method Authorization<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 48–72 **Vulnerability Type**: Insufficient endpoint and method validation **Risk Level**: Medium ### Vulnerable Code ```bash # This skill's helper is limited to its documented Crawlora route set. Keep # caller-account surfaces and unrelated API routes out of the helper even if # someone supplies an undocumented path directly. case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the wish-research skill" >&2 exit 2 ;; esac # Reject path syntax that could smuggle a route through a shell glob check. case "$path" in ""|*[?#%]*|*..*|*//* ) echo "invalid path for the wish-research skill" >&2 exit 2 ;; esac case "$path" in /wish/categories) ;; /wish/product/*) ;; /wish/product/*/related) ;; /wish/product/*/reviews) ;; /wish/search) ;; /wish/suggest) ;; *) echo "path is not in the wish-research skill catalog" >&2 exit 2 ;; esac ``` ### Technical Analysis The documented Skill functionality consists of six read-only `GET` endpoints. However, the helper authorizes both `GET` and `POST` for every accepted path. This grants a request capability that is not required by the declared Wish research functionality. The path allowlist also uses the broad shell pattern `/wish/product/*`. In shell pattern matching, `*` can include slash characters, so this rule accepts arbitrary trailing path segments below `/wish/product/`. Because it appears before the more specific related-items and reviews rules, those later rules do not meaningfully restrict matching. The helper also does not enforce the documented requirement that a product ID be exactly 24 hexadecimal characters. As a result, a caller can submit an authenticated POST request with an arbitrary body to an undocumented path beneath `/wish/product/`. The helper will attach the user's `CRAWLORA_API_KEY` and transmit the request to the fixed Crawlora API origin. Alt ...[truncated 1485 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove POST support and require the only method documented by the endpoint reference: ```bash [ "$method" = "GET" ] || { echo "only GET is supported by the wish-research skill" >&2 exit 2 } ``` 2. Replace the broad route glob with exact route-shape validation. Extract and validate product IDs against `^[0-9a-fA-F]{24}$`, and allow only: - `/wish/categories` - `/wish/search` - `/wish/suggest` - `/wish/product/{24-character hexadecimal ID}` - `/wish/product/{24-character hexadecimal ID}/related` - `/wish/product/{24-character hexadecimal ID}/reviews` 3. Reject additional path segments rather than relying on `/wish/product/*`. 4. Add endpoint-specific query-parameter allowlists: - No parameters for categories and product details. - `query`, `count`, and `offset` as appropriate for search. - `query` only for suggestions. - `count` only for related items and reviews. 5. Validate numeric ranges and pagination constraints locally before sending authenticated requests. 6. Add negative tests confirming that POST, malformed IDs, extra path components, unknown parameters, and out-of-range values are rejected without making a network request. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill invokes shell-based helper commands but does not declare any tool scope or allowed-tools restrictions. That creates an unnecessary capability gap: an agent may be permitted to run broader shell commands than required, increasing the risk of command misuse, prompt-injection-driven execution, or unintended local access beyond the intended API helper.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low
Confidence
84% confidence
Finding
This markdown file documents that all requests require the `x-api-key: $CRAWLORA_API_KEY` header and call a remote API, but it does not include any warning about network transmission or handling of credentials. Under the markdown-specific SQP-2 criteria, descriptions that affect privacy or system integrity should disclose such behavior.

Static analysis

No suspicious patterns detected.