ClawHub
Back to skill

Security audit

pipintama-charts

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate hosted chart integration, but it uploads chart contents to an external service and makes charts shared by default without explicit user opt-in.

Install only if you are comfortable sending chart contents to Pipintama's hosted service. Avoid using it with confidential, regulated, or personal data unless you explicitly choose appropriate visibility and understand how links can be revoked or deleted.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:64
Finding

Potentially Sensitive Chart Data Is Uploaded with Shared Visibility by Default

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64–68
Vulnerability Type: Insecure default data-sharing configuration
Risk Level: Medium

Vulnerable Code Snippet:

text
4. Preserve the user intent in `source_text` instead of rewriting the task into something unrelated.
5. Default visibility to `shared` unless the user explicitly wants `public` or `private`.
6. Do not pass `workspace_id` unless the user explicitly provides one. Let the authenticated API key determine the workspace.
7. Call the MCP tool that matches the job.
8. Return the hosted viewer URL first.

Technical Analysis

The Skill instructs the agent to copy user-provided chart content into source_text, transmit it to the external Pipintama MCP service, and create the resulting hosted chart with shared visibility unless the user opts out.

Sending chart data to the declared external service is necessary for the hosted-chart functionality. However, defaulting the resulting resource to shared visibility exceeds the minimum access required to generate a chart. User input may contain confidential financial, business, personal, or operational information. The Skill does not require explicit consent before external transmission, sensitivity screening, redaction, or disclosure of storage and retention implications.

Shared charts may be accessible through tokenized links. Such links are bearer-like access artifacts and can be exposed through chat transcripts, browser history, application logs, analytics systems, HTTP referrer data, or accidental forwarding.

Attack Path

  1. A user requests a chart using confidential or sensitive values.
  2. The agent preserves those values in the source_text field.
  3. The agent sends source_text to https://api.pipintama.com/mcp.
  4. The service creates a hosted chart with shared visibility by default.
  5. The agent returns the hosted viewer URL in the conversation.
  6. The URL is cop ...[truncated 772 chars]
Remediation
View remediation

Remediation Suggestions

  1. Change the default visibility from shared to private.
  2. Require explicit user authorization before changing visibility to shared or public.
  3. Clearly disclose that chart titles, labels, and source values will be transmitted to an external hosted service.
  4. Request confirmation before uploading data that may be confidential, regulated, or personally identifiable.
  5. Add sensitivity screening and offer to redact, aggregate, anonymize, or replace sensitive values before transmission.
  6. Return tokenized share links only when sharing is explicitly requested and warn users that anyone possessing such a link may be able to access the chart.
  7. Document the service's retention, deletion, access-token expiration, revocation, and workspace-isolation behavior.
  8. Avoid placing share tokens in logs or analytics, and configure appropriate referrer and cache protections where supported.
  9. Provide a deletion or link-revocation workflow for charts created accidentally with sensitive content.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This skill sends user-supplied chart data to an external hosted MCP endpoint, which is an actual data egress boundary. In context this is expected functionality, but it is still security-relevant because the transferred content may contain sensitive information and the skill does not require a user-facing confirmation before transmission.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
Primary MCP endpoint:

- `https://api.pipintama.com/mcp`

Access model:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
Health check:

- `https://api.pipintama.com/mcp-health`

Primary tools:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

md
Health check:

- `https://api.pipintama.com/mcp-health`

Primary tools:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

md
Health check:

- `https://api.pipintama.com/mcp-health`

Primary tools:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to default chart visibility to shared, which can expose user-provided data through hosted links without an explicit opt-in or warning. In a charting skill, users may include sensitive business metrics or personal data in source_text, so sharing by default increases the chance of unintended external disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.