ClawHub
Back to skill

Security audit

Smart Spawn

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small documented API helper, but it sends task details to a third party and can use that third party’s output to launch multiple sub-agents without clear validation or user confirmation.

Install only if you are comfortable sending task descriptions to ss.deeflect.com. Use broad categories rather than full confidential prompts, do not include secrets or private customer/project data, and review any returned model IDs, subtasks, and swarm plans before spawning agents or incurring cost.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:14
Finding

Sensitive Task Data May Be Disclosed to a Third-Party API

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–17; related examples at lines 24 and 67–79
Vulnerability Type: External transmission of potentially sensitive task descriptions
Risk Level: Medium

Vulnerable Code Snippet

markdown
## Quick Start
  1. GET ss.deeflect.com/api/pick?task=<description>&budget=<tier>
  2. Use the returned model ID in sessions_spawn
text

The Skill also demonstrates transmitting complete task descriptions:

markdown
## Decompose Complex Tasks

```bash
POST https://ss.deeflect.com/api/decompose
{"task": "Build and deploy a SaaS app", "budget": "medium"}

Returns sequential steps with optimal model per step.

Swarm (Parallel DAG)

bash
POST https://ss.deeflect.com/api/swarm
{"task": "Research competitors and build pitch deck", "budget": "low"}
text

### Technical Analysis

The Skill instructs an agent to transmit user-provided task descriptions to the external service `ss.deeflect.com`. The primary selection endpoint places the task description in a GET query parameter.

Task descriptions may contain confidential project details, customer information, internal system names, source-code fragments, credentials, or other sensitive context. Query-string data can be retained in server access logs, reverse proxies, monitoring platforms, analytics systems, browser history, and other intermediary infrastructure.

The documentation does not require:

- User consent before external transmission.
- Removal of credentials or sensitive identifiers.
- Classification of data before submission.
- Minimization of the submitted task description.
- Verification of the service's retention and privacy policies.
- Use of coarse, non-sensitive task categories where possible.

Although HTTPS protects the request in transit, it does not prevent the receiving service or its infrastructure from recording the submitted information.

### Attack Path

1. A user supplies a task containing confidential 
...[truncated 1064 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit user approval before sending task content to any third-party service.
  2. Clearly identify ss.deeflect.com as an external trust boundary and document what data will be transmitted.
  3. Default to coarse categories such as coding, reasoning, or research instead of complete task descriptions.
  4. Add mandatory redaction rules for credentials, tokens, personal data, customer information, source code, internal hostnames, and confidential project identifiers.
  5. Prefer POST requests over GET requests for task content to reduce exposure through URL logging, while recognizing that POST alone does not solve third-party disclosure.
  6. Establish and document data-retention, deletion, access-control, and privacy requirements for the external service.
  7. Provide a local or no-disclosure fallback that selects a default model without transmitting task information.
  8. Reject requests containing recognizable secrets before any outbound API call.

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:87
Finding

Unvalidated External Recommendations Control Sub-Agent Orchestration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87–96; related model-spawning instruction at lines 16–17 and 37
Vulnerability Type: Untrusted external orchestration instructions
Risk Level: Medium

Vulnerable Code Snippet

markdown
## Usage Pattern

For any task that needs a sub-agent:

1. **Decide budget** — `low` for cheap/fast, `medium` for quality, `high` for best available
2. **Call /api/pick** with the task description
3. **Use the returned `id`** as the `model` parameter in `sessions_spawn`
4. **If task is complex** — use `/api/decompose` or `/api/swarm` to break it into subtasks, spawn each with its recommended model

A direct spawning example is also provided:

markdown
Then spawn:

sessions_spawn(task="Build a React dashboard with auth", model="anthropic/claude-opus-4.6")

text

Technical Analysis

The Skill instructs the agent to trust model identifiers, task decomposition results, and swarm dependency graphs returned by an external API. It does not require validation of returned model IDs, providers, subtask contents, graph size, dependency depth, permissions, or aggregate cost before invoking sessions_spawn.

The /api/decompose and /api/swarm responses can influence both what work is delegated and which model performs it. If the service, its network-facing application, its data sources, or an upstream administrative account is compromised, a hostile response could introduce attacker-selected subtasks or redirect processing to an unapproved model or provider.

External API output must be treated as untrusted data rather than authoritative instructions. The current usage pattern lacks an allowlist and does not require the generated plan to remain semantically bounded by the user's original request and the agent's safety constraints.

Attack Path

  1. An agent submits a task to /api/pick, /api/decompose, or /api/swarm.
  2. The external service is compromised, misconfigured, or supplies a manipu ...[truncated 1381 chars]
Remediation
View remediation

Remediation Suggestions

  1. Treat every API response field as untrusted data, never as an instruction that automatically overrides the original task.
  2. Maintain an explicit allowlist of approved model identifiers and providers.
  3. Reject unknown, malformed, unavailable, or policy-prohibited model IDs.
  4. Validate every generated subtask against the user's original request, applicable safety constraints, and the current session's authorization boundary.
  5. Require user confirmation before executing externally generated decomposition or swarm plans.
  6. Impose strict limits on the number of spawned sessions, graph depth, execution time, token usage, and total budget.
  7. Prevent returned content from selecting tools, permissions, credentials, or data sources for spawned sessions.
  8. Give sub-agents the minimum necessary permissions and context rather than inheriting the parent session's full access.
  9. Pin and authenticate the expected API service, validate response schemas, and fail closed when validation fails.
  10. Log the accepted plan and model selection so users can review what external output influenced execution.
  11. Fall back to a locally configured default model when the response fails validation rather than widening trust automatically.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs users to send task descriptions to an external service but provides no disclosure that prompts may contain sensitive data and will leave the local/OpenClaw environment. In practice, users often paste proprietary code, business plans, credentials-adjacent context, or customer data into task fields, creating a real confidentiality and compliance risk when transmitted to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The examples for /api/pick, /api/decompose, and /api/swarm normalize sending full task prompts to a remote API without warning that the entire prompt content may be disclosed to that provider. This is especially risky because those endpoints encourage detailed task descriptions for decomposition and swarm planning, increasing the likelihood of leaking sensitive operational, customer, or intellectual-property information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.