ClawHub
Back to skill

Security audit

Booking Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate booking-management purpose, but it needs Review because it persists free-form setup text into agent instruction files and uses unsanitized booking data in outbound emails while holding booking and email authority.

Review this skill before installing. Use least-privilege SMTP and booking-system credentials, do not let untrusted customers or staff provide onboarding text unchecked, store configuration as data rather than instructions where possible, and require HTML escaping or sanitization before sending customer emails.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:111
Finding

Persistent Prompt Injection Through Untrusted Onboarding Data

Content
View full analysis
## Booking Policy - [policy text or "No specific policy"] ## Booking Data Source - Type: [system mentioned or "pending setup"] - Connection: [pending admin configuration] ## Notifications - Channel: [preference] - Mobile: [number] ``` ``` The fallback flow reiterates the persistence behavior: ```markdown 7. "Anything else I should know about how you run bookings?" Write to TOOLS.md using the same format and show the same summary. ``` ### Technical Analysis The Skill instructs the Agent to take free-form customer input—including booking policies, business details, service names ...[truncated 2421 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/email-templates.md:9
Finding

Unescaped Customer and Business Data in HTML Email Templates

Content
View full analysis

Dear [NAME],

Thank you for your appointment enquiry with [BUSINESS_NAME].

Requested Date: [DATE]
Requested Time: [TIME]
Service: [SERVICE]
Phone: [PHONE]

Your enquiry has been received. Our team will contact you shortly to confirm availability.

[BOOKING_POLICY]

Please note: This email is an acknowledgement of your enquiry only.
A booking confirmation will follow shortly.

We look forward to welcoming you.
Please do not hesitate to reply if you have any questions.

Warm regards,
[BUSINESS_NAME]

``` The document also directs the Agent to place the business policy into the HTML body: ```markdown ## Booking Policy Block Replace `[BOOKING_POLICY]` with the business-specific policy. Example: ```html

Booking Policy

- A non-refundable deposit is required to secure your booking.
- Appointments may be rescheduled once with 48 hours' notice.
- Cancellations within 48 hours or no-shows forfeit the deposit.
- Please arrive on time. Late arrivals may need rescheduling.
- Frequent last-minute changes may affect future booking availability.

``` ``` Equivalent unescaped placeholders are present in the confirmation, cancellation, and reminder templat ...[truncated 2146 chars]
Remediation
View remediation
`, `"`, and `'`. 2. Treat names, service descriptions, phone numbers, business names, dates, times, and policies as plain text by default. 3. If rich-text policies are required, sanitize them with a strict allowlist of necessary formatting tags and attributes. 4. Explicitly reject: - Script and style elements - Forms and interactive controls - Event-handler attributes - Embedded objects and iframes - Remote images - Unsafe URI schemes such as `javascript:` and `data:` 5. Validate links against an administrator-approved domain allowlist before including them in emails. 6. Use a mature templating library with automatic contextual escaping rather than direct string replacement. 7. Generate a plain-text alternative for every HTML email. 8. Add tests using hostile values such as closing tags, image beacons, misleading anchor tags, CSS hiding, and malformed markup. 9. Perform sanitization immediately before rendering, even if values were validated during onboarding, to protect against data imported from external booking systems. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
- name: GOOGLE_SHEET_ID
          description: "Google Sheets spreadsheet ID"
        - name: GOOGLE_SHEETS_TOKEN
          description: "Google Sheets API access token (scoped service account)"
        - name: SHEET_RANGE
          description: "Google Sheets range (e.g. Sheet1!A:H)"
    network:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/data-sources.md (reported line 124)May include surrounding context.

md
- name: GOOGLE_SHEET_ID
          description: "Google Sheets spreadsheet ID"
        - name: GOOGLE_SHEETS_TOKEN
          description: "Google Sheets API access token (scoped service account)"
        - name: SHEET_RANGE
          description: "Google Sheets range (e.g. Sheet1!A:H)"
    network:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest lists generic triggers such as "booking assistant," "appointment manager," and "booking notifications" without clear scope limits or exclusion conditions. These phrases are broad enough to match ordinary conversation about booking tools, which could cause unintended activation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.