ClawHub
Back to skill

Security audit

book anything

Security checks for vulnerabilities and agentic risk

Overview

This booking skill is coherent, but it can place or change real phone reservations through an external service without clearly requiring user confirmation for high-impact actions.

Review before installing. Only use this skill when you intentionally want an external service to search businesses or call a merchant for you. Confirm all booking, cancellation, reschedule, contact, and language details before allowing a phone call or record update, and keep the LIFECLAW_API_TOKEN scoped and revocable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

High
Confidence
98% confidence
Finding
The skill description uses extremely broad trigger phrases such as 'find', 'book', 'reserve', 'cancel', 'reschedule', or asking about a local business. This can cause the agent to invoke a third-party action-capable skill for ordinary conversation or ambiguous requests, leading to unintended searches, calls, cancellations, or disclosure of user data to the external service.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The skill states that the AI caller automatically matches the merchant's language without user choice or opt-in. This can result in the system speaking on the user's behalf in a language the user did not approve, increasing the risk of misrepresentation, consent issues, and incorrect booking details being communicated.

External Transmission

Medium
Category
Data Exfiltration
Content
BASE_URL="https://api-v2.lifeclaw.agentese.ai"

# 1. Search
curl -X POST "$BASE_URL/skill/search" \
  -H "Authorization: Bearer $LIFECLAW_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "sushi near Shibuya", "location": "Tokyo"}'
Confidence
84% confidence
Finding
The skill sends user-supplied booking and contact information to an external API endpoint, including potentially sensitive personal data such as name, phone number, reservation details, and special requests. While this is core functionality, it is still a real data-exposure boundary and becomes risky if invocation is over-broad or users are not clearly informed and asked to consent before transmission.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
Auto-inferring call language from the merchant phone country can cause the AI caller to use the wrong language in multilingual regions or for merchants whose operating language differs from numbering country. In a booking/cancellation workflow, this can lead to misunderstood requests, incorrect reservations, accidental cancellations, or disclosure of user details to the wrong party during an automated call.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The manifest describes a skill for searching businesses and handling bookings, cancellations, reschedules, and merchant inquiries by phone. This API reference also exposes a balance endpoint and pricing/top-up flow, which are account-wallet capabilities not described as part of the skill's user-facing purpose.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
The documentation specifies a default `language` value of `"en"` for search results, which imposes a specific language choice in natural-language behavior. The file does not indicate that users can opt in to this default or that English is required for a region-specific or compliance reason.

Static analysis

No suspicious patterns detected.