Erp Integration Analysis

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:03 AM UTC
• Version: 2.1.0

Overview

The skill appears to be a local ERP analysis helper, but it requests network access without a documented need while handling potentially sensitive business data.

Install only if you are comfortable granting network access to a skill that may process ERP, financial, project, procurement, HR, payroll, or integration metadata. Prefer a version that removes network permission or clearly documents what hosts it contacts and what data it sends.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: claw.json:8

Finding

Unnecessary Network Permission Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: claw.json, lines 8–11
Vulnerability Type: Excessive runtime permission
Risk Level: Medium

Vulnerable Code

json

"permissions": [
  "filesystem",
  "network"
],

Technical Analysis

The Skill requests unrestricted network access even though its documented ERP-analysis operations process user-provided data locally. Neither SKILL.md nor instructions.md defines a feature that needs to send network requests or retrieve remote resources. The URLs in SKILL.md are informational references, and the embedded Python code contains no network client implementation.

The filesystem permission is consistent with accepting file paths and offering data exports. However, the network permission is not supported by the documented functionality and therefore violates the principle of least privilege. Although the current implementation contains no outbound request or data-exfiltration code, this unnecessary capability could become an outbound communication channel if the Skill's behavior were later compromised or influenced by untrusted input.

Attack Path

1. A user activates the Skill, and the runtime grants the permissions declared in claw.json.
2. The Skill receives network access despite having no legitimate network-dependent feature.
3. A future compromised implementation, malicious update, or successfully injected behavior invokes the granted network capability.
4. The malicious behavior connects to an attacker-controlled endpoint.
5. Data accessible during the Skill session could then be transmitted externally.

The current reviewed files do not implement steps 3–5; this finding concerns the exposed capability and resulting reduction in defense in depth rather than an observed active exfiltration mechanism.

Impact Assessment

The unnecessary permission expands the Skill's effective access from local data processing to outbound network communicati ...[truncated 328 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove "network" from the permissions array because the currently documented functionality does not require it.
2. Retain only the minimum filesystem capabilities needed to read user-selected input files and write explicitly requested exports.
3. If a future feature legitimately requires network access, document its purpose, destination, request method, and transmitted fields before enabling it.
4. Where the runtime supports scoped permissions, restrict connectivity to an explicit allowlist of trusted hosts rather than granting unrestricted network access.
5. Require user confirmation before transmitting project or ERP data and prevent credentials, tokens, and unrelated session data from being included.
6. Add automated manifest checks that reject permissions not mapped to documented and tested functionality.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The markdown explicitly cites a Russian title alongside its English translation, but the skill documentation does not state whether outputs, references, or user interaction may require Russian-language handling. Because SQP-3 covers language or locale policy issues, this can be read as an implicit language constraint without explicit user opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.