ClawHub
Back to skill

Security audit

LobsterLAN

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can send agent messages and reusable bearer tokens over plaintext HTTP to configured peers, so users should review the network setup carefully before installing.

Install only if you understand and control the peer agents and transport. Use localhost or an encrypted tunnel/TLS endpoint, keep peers.json private, use narrowly scoped and rotatable tokens, and avoid sending sensitive prompts or delegated tasks across direct LAN HTTP.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/lobsterlan.sh:88
Finding

Bearer Tokens and Agent Messages Transmitted over Plaintext HTTP

Content
View full analysis
&1) ``` Asynchronous delegation has the same issue: ```bash local url="http://${host}:${port}/hooks/agent" warn_if_not_localhost "$host" local response response=$(curl -sS --max-time 10 "$url" \ -H "Authorization: Bearer ${token}" \ -H "Content-Type: application/json" \ -H "X-LobsterLAN-Agent: ${self_id}" \ -d "$(LOBSTERLAN_SELF="$self_id" python3 -c " import json, sys, os msg = sys.stdin.read() print(json.dumps({ 'message': msg, 'name': os.environ['LOBSTERLAN_SELF'], 'wakeMode': 'now', 'deliver': False })) " <<< "$message")" 2>&1) ``` ### Technical Analysis Both authenticated communication paths construct URLs with a fixed `http://` scheme. Requests include gateway or webhook bearer tokens, the local agent identity, and user-supplied messages. Responses to synchronous requests also travel over the same unencrypted connection. The function `warn_if_not_localhost` warns when the destination is not loopback, but it does not stop the request. Consequently, a user can unintentionally transmit credentials and potentially sensitive task data over an untrusted or compromised LAN. The e ...[truncated 2550 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/lobsterlan.sh (reported line 100)May include surrounding context.

sh
warn_if_not_localhost "$host"

  local response
  response=$(curl -sS --max-time 120 "$url" \
    -H "Authorization: Bearer ${token}" \
    -H "Content-Type: application/json" \
    -H "X-LobsterLAN-Agent: ${self_id}" \

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs users to run shell commands and relies on environment/configuration (peers.json, LOBSTERLAN_CONFIG), but it does not declare any permissions or allowed-tools scope in the skill metadata. That mismatch can cause the hosting agent to expose broader-than-intended execution capability or make reviewers/users unaware that shell and environment access are required, increasing the risk of misuse or command execution against network peers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends prompts, agent identifiers, and a bearer token to peers using plain HTTP, which allows anyone on the local network path to observe or tamper with the traffic. The warning to stderr is not meaningful protection because transmission still proceeds automatically, so sensitive content and credentials may be exposed without strong user awareness or transport security.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This is a real external transmission of user-supplied message content, agent identity, and an authorization token to a configured peer. In this skill, exfiltration is part of intended functionality, but it still creates security risk because the destination is remote and transport is not protected.

Content

Scanner excerpt · scripts/lobsterlan.sh (reported line 100)May include surrounding context.

sh
warn_if_not_localhost "$host"

  local response
  response=$(curl -sS --max-time 120 "$url" \
    -H "Authorization: Bearer ${token}" \
    -H "Content-Type: application/json" \
    -H "X-LobsterLAN-Agent: ${self_id}" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Async delegation sends arbitrary message content and an authorization token to a remote webhook over plaintext HTTP, making interception and modification feasible on the LAN. Because delegation is designed to forward tasks to other agents, the content may include sensitive instructions or data, increasing the likelihood of confidentiality loss and command tampering.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This curl call transmits delegated task content and authentication material to another system, so the finding is accurate as an external transmission. While expected for the feature, it expands trust boundaries and can expose sensitive task data if the peer or network is compromised.

Content

Scanner excerpt · scripts/lobsterlan.sh (reported line 162)May include surrounding context.

sh
warn_if_not_localhost "$host"

  local response
  response=$(curl -sS --max-time 10 "$url" \
    -H "Authorization: Bearer ${token}" \
    -H "Content-Type: application/json" \
    -H "X-LobsterLAN-Agent: ${self_id}" \

Static analysis

No suspicious patterns detected.