ClawHub
Back to skill

Security audit

Slug Test

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent health-sync purpose, but it asks users to expose highly sensitive health data services publicly with weakly scoped admin protection and an unpinned executable dependency.

Review carefully before installing. Use a pinned, auditable server version; set a strong ADMIN_TOKEN before any public exposure; restrict or protect /admin/* routes; run the service under a least-privileged account; and treat the local JSONL/SQLite files as sensitive health records requiring encryption, retention limits, and secure backups.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:40
Finding

Unpinned npm Package Is Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40–43
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash
npx healthclaw-webhook-server

Technical Analysis

The setup instructions execute healthclaw-webhook-server through npx without specifying an exact package version or integrity hash. Depending on the local npm environment, npx may download the current registry release and immediately execute its installation or runtime code with the invoking user's privileges.

The reviewed project contains only documentation and metadata; it does not include the webhook server's source code, a lockfile, or integrity information. Therefore, the effective executable payload is outside this audit scope and can change after the skill has been reviewed. Registry account compromise, package takeover, or a malicious future release could turn the documented setup command into arbitrary local code execution.

Attack Path

  1. An attacker compromises the npm publisher account, package registry entry, or another part of the package's release pipeline.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the skill's setup instructions and runs npx healthclaw-webhook-server.
  4. npx retrieves the current package release because no exact version is specified.
  5. Malicious package code executes with the privileges of the user who launched the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. The malicious package could access or modify user-readable files, steal locally stored health records and tokens, alter webhook data, or establish additional persistence. The exact scope depends on the account's privileges and host configuration; the documentation does not request elevated privileges.

Remediation
View remediation

Remediation Suggestions

  • Pin the command to a reviewed exact version, for example npx healthclaw-webhook-server@X.Y.Z, rather than resolving the latest release.
  • Publish and link the server's source repository so its implementation can be independently audited.
  • Provide a lockfile or documented package-integrity verification procedure.
  • Recommend installing and running the server under a dedicated, unprivileged service account with access only to its required data directory.
  • Use automated dependency and release-pipeline security checks, signed releases, protected publisher accounts, and multi-factor authentication.
  • Re-audit each package version before updating the version referenced by the skill.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:47
Finding

Publicly Exposed Administrative Pairing Endpoint May Lack Authentication

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–52 and 109–112
Vulnerability Type: Optional administrative authentication on a public service
Risk Level: High

Vulnerable Code

bash
Optional environment variables:
```bash
PORT=3000                         # Server port
HEALTHCLAW_DATA_DIR=~/custom/path # Override data directory
ADMIN_TOKEN=your-secret           # Protect admin endpoints
text

The documented pairing request is then made without administrative credentials:

```bash
curl -X POST https://your-public-url/admin/generate-pairing

Technical Analysis

The skill instructs users to expose the webhook server through a public HTTPS tunnel, while ADMIN_TOKEN is described as optional. The normal pairing example invokes the administrative pairing endpoint without an x-admin-token or another authentication credential.

The endpoint generates a time-limited pairing token and deep link used to exchange pairing authorization for a permanent API token. If the external server behaves as documented and permits unauthenticated administration when ADMIN_TOKEN is unset, anyone who discovers or receives the public URL may be able to generate pairing credentials.

The webhook server implementation is not included in the reviewed project. Consequently, this audit cannot confirm its exact token invalidation behavior, whether completing an unauthorized pairing replaces an existing device, or which additional administrative endpoints remain accessible. The documented default deployment pattern nevertheless creates an unsafe access-control configuration.

Attack Path

  1. A user starts the webhook server without setting ADMIN_TOKEN, following the documented optional configuration.
  2. The user exposes port 3000 through Tailscale Funnel, Cloudflare Tunnel, or ngrok as directed by the setup guide.
  3. An attacker learns or discovers the resulting public URL.
  4. The attacker sends ...[truncated 1049 chars]
Remediation
View remediation

Remediation Suggestions

  • Require a cryptographically strong administrator token before the server starts; do not allow an unauthenticated production mode.
  • Update every administrative request example to include an authentication header, such as:
    bash
    curl -X POST https://your-public-url/admin/generate-pairing \
  -H "x-admin-token: $ADMIN_TOKEN"
  • Bind administrative endpoints to localhost or a private management interface and expose only the synchronization endpoints through the public tunnel.
  • Separate public and administrative routes at the reverse proxy and enforce authentication before forwarding /admin/*.
  • Apply rate limits, request logging, short token expiration, one-time token consumption, and invalidation of outstanding pairing tokens after successful pairing.
  • Prevent a new pairing from replacing an existing paired device without authenticated administrator approval.
  • Avoid placing pairing tokens in logs, analytics, referrer headers, or other persistent records.
  • Document secure secret generation, storage, rotation, and recovery procedures.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

External Script Fetching

High
Category
Supply Chain
Confidence
60% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md
Open `openUrl` on your iPhone, or paste `deepLink` into Safari. The page has a button
that opens the HealthClaw app directly.

> **Token expires in 2 minutes.** If it expires, run the curl command again.

### 4. Install the iOS app

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill instructs users to run npx healthclaw-webhook-server without pinning a specific package version. That allows whatever version is currently published under that package name to be fetched and executed, creating a supply-chain risk where a compromised or malicious update could run arbitrary code on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This is a second occurrence of the same unsafe pattern: invoking an unpinned package via npx. Because npx may download and execute the latest remote package version at runtime, users are exposed to remote code execution if the dependency or publisher account is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation presents admin endpoints and notes ADMIN_TOKEN as optional, without a strong warning that failing to configure it may leave administrative functions reachable from the public internet. Given the later instructions to expose the service through Tailscale Funnel, Cloudflare Tunnel, or ngrok, an unprotected admin API could enable unauthorized pairing, user creation, or device-management actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill tells users to expose a webhook server to the public internet for health-data sync, but it does not clearly warn that highly sensitive medical and behavioral data will be transmitted to a public endpoint and stored locally in plaintext-style JSONL files. In context, this materially increases privacy and security risk because users may deploy the service without understanding the exposure or securing the host appropriately.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

Create a user

bash
curl -X POST https://your-public-url/admin/users \
  -H "Content-Type: application/json" \
  -H "x-admin-token: your-secret" \
  -d '{"name": "alice"}'

Static analysis

No suspicious patterns detected.